Stored Cross-Site Scripting in SurveyKing by JavaHuang

CVE-2026-129154

What is CVE-2026-129154?

SurveyKing versions 1.13.0 through 1.13.2 contain a vulnerability that allows for stored cross-site scripting. This occurs when the server accepts a respondent-supplied survey snapshot. The vulnerability arises because the titles of these snapshots are rendered on the frontend using innerHTML, exposing the application to the potential injection of malicious scripts. An attacker can create a forged snapshot with embedded event handlers that execute in an administrator's browser session when the response is viewed, potentially leading to unauthorized actions or data exposure.

References