CVE-2026-1901

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1901", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-04T14:49:31.230Z", "datePublished": "2026-02-14T06:42:27.139Z", "dateUpdated": "2026-04-08T16:45:01.608Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:45:01.608Z"}, "affected": [{"vendor": "questionpro", "product": "QuestionPro Surveys", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The QuestionPro Surveys plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'questionpro' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "QuestionPro Surveys <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3121bb03-7bc0-4005-9814-bc46ce9d4a9d?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/questionpro-surveys/trunk/index.php#L31"}, {"url": "https://plugins.trac.wordpress.org/browser/questionpro-surveys/tags/1.0/index.php#L31"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Gilang Asra Bilhadi"}], "timeline": [{"time": "2026-02-13T18:26:37.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-17T15:36:48.687954Z", "id": "CVE-2026-1901", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-17T15:47:35.366Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1901", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-17T15:36:48.687954Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-17T15:36:49.392Z"}}], "cna": {"title": "QuestionPro Surveys <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes", "credits": [{"lang": "en", "type": "finder", "value": "Gilang Asra Bilhadi"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "questionpro", "product": "QuestionPro Surveys", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-13T18:26:37.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3121bb03-7bc0-4005-9814-bc46ce9d4a9d?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/questionpro-surveys/trunk/index.php#L31"}, {"url": "https://plugins.trac.wordpress.org/browser/questionpro-surveys/tags/1.0/index.php#L31"}], "descriptions": [{"lang": "en", "value": "The QuestionPro Surveys plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'questionpro' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-02-14T06:42:27.139Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1901", "state": "PUBLISHED", "dateUpdated": "2026-02-17T15:47:35.366Z", "dateReserved": "2026-02-04T14:49:31.230Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-14T06:42:27.139Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "QuestionPro Surveys", "vendor": "questionpro", "versions": [{"lessThanOrEqual": "1.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The QuestionPro Surveys plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'questionpro' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin QuestionPro Surveys para WordPress es vulnerable a Cross-Site Scripting Almacenado a trav\u00e9s del shortcode 'questionpro' en todas las versiones hasta la 1.0, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes en los atributos proporcionados por el usuario. Esto permite que atacantes autenticados, con acceso de nivel Colaborador o superior, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2026-1901", "lastModified": "2026-06-17T10:16:41.647", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1901", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-17T15:36:48.687954Z", "version": "2.0.3"}}]}, "published": "2026-02-14T07:16:11.113", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/questionpro-surveys/tags/1.0/index.php#L31"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/questionpro-surveys/trunk/index.php#L31"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3121bb03-7bc0-4005-9814-bc46ce9d4a9d?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.0]"}}], "product": "questionpro_surveys", "vendor": "questionpro"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T20:39:37.385826+00:00", "value": {"mitigation_remediation": ["Upgrade the QuestionPro Surveys plugin to the latest version released after 1.0, which addresses the XSS issue.", "If an immediate upgrade is not possible, restrict Contributor role capabilities or temporarily revoke the ability for contributors to edit or create surveys containing the 'questionpro' shortcode.", "Implement a content security policy that restricts script execution and blocks inline scripts on the survey pages.", "Apply a site\u2011wide input sanitization layer or WordPress security plugin that automatically escapes shortcode attributes before storage."], "summary": {"action": "Patch Update", "impact": "Stored Cross\u2011Site Scripting allowing authenticated contributors to inject scripts into survey pages"}, "threat_synthesis": {"affected_systems": "All installations of the QuestionPro Surveys WordPress plugin up to and including version 1.0. The affected component is the plugin\u2019s handling of shortcode attributes within the WordPress environment.", "description_and_impact": "The vulnerability manifests as a stored XSS flaw caused by insufficient sanitization and escaping of user\u2011supplied attributes in the 'questionpro' shortcode. When an authenticated user with Contributor or higher privileges embeds malicious code via these attributes, the code is saved to the database and executed whenever any user visits the injected survey page. This flaw directly exploits CWE\u201179 and can lead to session hijacking, defacement, or theft of sensitive data from end users who load the affected page.", "risk_and_exploitability": "The CVSS score of 6.4 indicates moderate severity, while the EPSS score of less than 1% reflects a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation. An attacker must first obtain Contributor\u2011level or higher access to a site running the vulnerable plugin, after which they can inject persistent malicious script via the shortcode attributes. If successful, the code will execute in the browsers of any visitor to the affected survey page, potentially exposing credentials, session cookies, or other confidential information. The attack surface is constrained to sites that have deployed the vulnerable plugin version and allowed contributors to edit shortcodes."}}}}, "created": "2026-02-16T12:03:08.738748+00:00", "updated": "2026-04-15T20:45:06.386963+00:00", "vendors": ["questionpro", "questionpro$PRODUCT$questionpro_surveys", "wordpress", "wordpress$PRODUCT$wordpress"]}