CVE-2026-129154 · Other
NO FIX YET
SurveyKing 1.13.0 through 1.13.2 accepts a survey snapshot from respondents and renders its titles with innerHTML, so the page stores attacker-supplied markup. An anonymous respondent can embed event handlers such as img onerror that run in an administrator's browser session when a response is viewed.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that self-host SurveyKing 1.13.0 through 1.13.2 and let anonymous respondents submit surveys are exposed, because the forged snapshot is stored and runs when an admin views responses. Instances on other versions, or where administrators do not view responses in a browser, are not shown to be affected by the sources.
Not affected if no-admin-response-view, version-outside-range
Who cares self-hosted, surveyking, web
1.13.0 through 1.13.2.No fix yet, per the sources.
SurveyKing 1.13.0 through 1.13.2 contains a stored cross-site scripting vulnerability because the server accepts a respondent-supplied survey snapshot and the frontend renders its titles via innerHTML. Anonymous respondents can submit a forged snapshot embedding event handlers such as img onerror that execute in an administrator's browser session when the response is viewed.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.