Executive brief
LimeSurvey is an open-source survey platform used to create online questionnaires and collect responses. An authenticated administrator with certain permissions can inject malicious JavaScript code via the Survey Menu Entries administration page. When other users view the affected page, the injected code executes in their browsers, potentially allowing account takeover, data theft, or unauthorized actions performed on behalf of the victim.
Technical details
This vulnerability is a stored cross-site scripting (XSS) flaw in the Survey Menu Entries administration page. An authenticated user with global settings:read permission can create a survey menu entry containing attacker-controlled HTML/JavaScript. The malicious payload is stored in the surveymenu_entries.data database field and later rendered into a single-quoted HTML title attribute without proper encoding. Because the attribute lacks context-appropriate output encoding, the injected code is not neutralized and executes with the privileges of users who view the page. This is a post-authentication vulnerability requiring the attacker to have specific administrative permissions.
Affected products
- LimeSurvey Community Edition 7.0.5
Timeline
- 2026-08-26: disclosed