Cross-site scripting in Survey Creator

Description

Cross Site Scripting (XSS) vulnerability in SurveyJS Survey Creator v.1.9.132 and before, allows attackers to execute arbitrary code and obtain sensitive information via the title parameter in form.

Recommendation

Update the survey-creator package to the latest compatible version. Followings are version details:

Affected version(s): < 1.9.133
Patched version(s): 1.9.133

References

GHSA-xgj4-2hrf-j4xg
packetstormsecurity.com
CVE-2024-28635
CWE-79
CAPEC-310
OWASP 2021-A3
OWASP 2021-A6

Could your website be exposed too?

SmartScanner can check your website for Cross-site scripting in Survey Creator and gives you actionable findings to investigate.

Start a free scan

Related Issues

DOM clobbering could escalate to Cross-site Scripting (XSS) - CVE-2024-45389
DOM clobbering could escalate to Cross-site Scripting (XSS) - pagefind - CVE-2024-45389
DOM clobbering could escalate to Cross-site Scripting (XSS) - @pagefind/default-ui - CVE-2024-45389
VvvebJs Reflected Cross-Site Scripting (XSS) vulnerability - CVE-2024-29271

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

See something that needs correcting? Let us knowUpdated June 11, 2026