CVE-2026-1901
Stored XSS in QuestionPro Surveys WordPress Plugin Allows Script Injection
Publication date: 2026-02-14
Last updated on: 2026-02-14
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| questionpro | surveys | to 1.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "The QuestionPro Surveys plugin for WordPress up to version 1.0 is vulnerable to Stored Cross-Site Scripting (XSS) via the 'questionpro' shortcode. This happens because the plugin does not properly sanitize or escape user-supplied attributes such as 'url', 'width', and 'height' before embedding them into an iframe element. As a result, authenticated users with Contributor-level access or higher can inject malicious scripts that will execute whenever any user views the affected page."}] [1]
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': "This vulnerability allows attackers with Contributor-level access or above to inject arbitrary web scripts into pages via the 'questionpro' shortcode. These scripts execute in the context of users visiting the infected pages, potentially leading to theft of user credentials, session hijacking, defacement, or distribution of malware. Because the attack is stored, the malicious code persists and affects all users who access the compromised content."}] [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': "Detection of this vulnerability involves identifying the presence of the QuestionPro Surveys WordPress plugin version 1.0 or earlier and checking for usage of the 'questionpro' shortcode with potentially malicious attributes."}, {'type': 'paragraph', 'content': "Since the vulnerability arises from insufficient input sanitization on the 'url', 'width', and 'height' attributes of the shortcode, you can search your WordPress content or database for instances of the '[questionpro]' shortcode containing suspicious or script-injected attribute values."}, {'type': 'paragraph', 'content': 'On the server or WordPress installation, you can run commands to find the plugin version and scan for shortcode usage. For example:'}, {'type': 'list_item', 'content': "Check plugin version by inspecting the plugin directory or plugin files: `grep -r 'Version' wp-content/plugins/questionpro-surveys/`"}, {'type': 'list_item', 'content': "Search WordPress posts or pages for the shortcode usage: `grep -r '\\[questionpro' wp-content/uploads/ wp-content/themes/ wp-content/plugins/`"}, {'type': 'list_item', 'content': "Search the WordPress database for posts containing the shortcode with suspicious attributes (requires database access): `SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%[questionpro%';`"}, {'type': 'paragraph', 'content': "Additionally, monitoring web traffic for unusual script execution or iframe injections related to the 'questionpro' shortcode may help detect exploitation attempts."}] [1]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'Immediate mitigation steps include:'}, {'type': 'list_item', 'content': 'Update the QuestionPro Surveys plugin to a version that fixes the vulnerability, if available.'}, {'type': 'list_item', 'content': 'If no update is available, disable or remove the QuestionPro Surveys plugin to prevent exploitation.'}, {'type': 'list_item', 'content': 'Restrict Contributor-level and higher user permissions to trusted users only, as the vulnerability requires authenticated users with Contributor-level access or above.'}, {'type': 'list_item', 'content': "Review and sanitize any existing content using the '[questionpro]' shortcode to remove malicious scripts."}, {'type': 'list_item', 'content': 'Implement Web Application Firewall (WAF) rules to block attempts to inject scripts via the shortcode attributes.'}] [1]