CVE-2025-13205

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13205", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-14T17:24:30.640Z", "datePublished": "2026-01-24T09:08:09.131Z", "dateUpdated": "2026-04-08T17:28:53.596Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:28:53.596Z"}, "affected": [{"vendor": "devsoftbaltic", "product": "SurveyJS: Drag & Drop Form Builder", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.5.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.2. This is due to missing or incorrect nonce validation on the `SurveyJS_CloneSurvey` AJAX action. This makes it possible for unauthenticated attackers to duplicate surveys via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity <= 2.5.2 - Cross-Site Request Forgery to Survey Cloning", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e1179303-fe7c-47f1-958c-2e4d2c574e4a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/surveyjs/tags/1.12.20/ajax_handlers/clone_survey.php#L8"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Nur Ibnu Hubab"}], "timeline": [{"time": "2026-01-23T20:33:47.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-26T15:28:57.400262Z", "id": "CVE-2025-13205", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-26T15:44:21.874Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13205", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-14T17:24:30.640Z", "datePublished": "2026-01-24T09:08:09.131Z", "dateUpdated": "2026-01-26T15:44:21.874Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-01-24T09:08:09.131Z"}, "affected": [{"vendor": "devsoftbaltic", "product": "SurveyJS: Drag & Drop Form Builder", "versions": [{"version": "*", "status": "affected", "lessThanOrEqual": "1.12.20", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.12.20. This is due to missing or incorrect nonce validation on the `SurveyJS_CloneSurvey` AJAX action. This makes it possible for unauthenticated attackers to duplicate surveys via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity <= 1.12.20 - Cross-Site Request Forgery to Survey Cloning", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e1179303-fe7c-47f1-958c-2e4d2c574e4a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/surveyjs/tags/1.12.20/ajax_handlers/clone_survey.php#L8"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Nur Ibnu Hubab"}], "timeline": [{"time": "2026-01-23T20:33:47.000+00:00", "lang": "en", "value": "Disclosed"}]}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13205", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-26T15:28:57.400262Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-26T15:29:24.948Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "SurveyJS: Drag & Drop Form Builder", "vendor": "devsoftbaltic", "versions": [{"lessThanOrEqual": "2.5.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.2. This is due to missing or incorrect nonce validation on the `SurveyJS_CloneSurvey` AJAX action. This makes it possible for unauthenticated attackers to duplicate surveys via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin SurveyJS: Drag &amp; Drop WordPress Form Builder to create, style and embed multiple forms of any complexity para WordPress es vulnerable a la falsificaci\u00f3n de petici\u00f3n en sitios cruzados en todas las versiones hasta la 1.12.20, inclusive. Esto se debe a la validaci\u00f3n de nonce faltante o incorrecta en la acci\u00f3n AJAX 'SurveyJS_CloneSurvey'. Esto hace posible que atacantes no autenticados dupliquen encuestas mediante una petici\u00f3n falsificada siempre que puedan enga\u00f1ar a un administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-13205", "lastModified": "2026-06-17T08:33:40.953", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13205", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-26T15:28:57.400262Z", "version": "2.0.3"}}]}, "published": "2026-01-24T09:15:51.880", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/surveyjs/tags/1.12.20/ajax_handlers/clone_survey.php#L8"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e1179303-fe7c-47f1-958c-2e4d2c574e4a?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T00:19:11.761935+00:00", "value": {"mitigation_remediation": ["Upgrade the SurveyJS plugin to any release newer than 2.5.2 that implements proper nonce validation on the clone survey AJAX action.", "Configure the SurveyJS_CloneSurvey AJAX endpoint to accept requests only from users with administrator capability, adding a capability check in the plugin\u2019s code or via a custom function hooked to the AJAX action.", "Adopt multi\u2011factor authentication for administrator accounts and limit the use of the cloning feature to trusted personnel to reduce the risk of social\u2011engineering attacks."], "summary": {"action": "Patch", "impact": "Unauthenticated cloning of surveys via CSRF leading to data duplication and potential disclosure"}, "threat_synthesis": {"affected_systems": "The vulnerability affects all versions of devsoftbaltic\u2019s SurveyJS Drag & Drop Form Builder up to and including 2.5.2. WordPress sites that have installed any of these plugin versions are susceptible; site administrators who grant media or form creation privileges are at risk.", "description_and_impact": "The SurveyJS Drag & Drop WordPress Form Builder contains a CSRF vulnerability due to missing or incorrect nonce validation on the SurveyJS_CloneSurvey AJAX action. An attacker can send a forged request that, when an administrator clicks a link or visits a malicious page, causes the site to duplicate a survey without the administrator\u2019s consent. The result is unauthorized replication of survey definitions, potential exposure of sensitive respondent data, and clutter of the site with unwanted copies.", "risk_and_exploitability": "The CVSS score of 4.3 indicates moderate impact, while the EPSS score of less than 1% suggests a low likelihood of exploitation at the time of assessment. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an unauthenticated attacker to lure an administrator into performing the clone form action, typically via social engineering or a malicious link. Once triggered, the attacker can duplicate surveys and thereafter use or delete them as desired."}}}}, "created": "2026-01-26T11:48:35.208815+00:00", "updated": "2026-04-21T00:30:22.965484+00:00", "vendors": ["devsoftbaltic", "devsoftbaltic$PRODUCT$surveyjs_drag_drop_wordpress_form_builder", "wordpress", "wordpress$PRODUCT$wordpress"]}