Executive brief
LimeSurvey Community Edition is an open-source survey and form creation platform. Version 7.0.5 contains a stored cross-site scripting vulnerability in the survey quota creation workflow that allows low-privileged authenticated users to inject malicious JavaScript code. When other users view the quota message, the injected script executes in their browser, potentially leading to session hijacking, data theft, or malicious actions performed on their behalf.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in the quota message rendering component of LimeSurvey Community Edition 7.0.5. An authenticated low-privileged user with survey creation and management permissions can inject malicious JavaScript into a quota message field, which is then stored in the database without proper sanitization. When other users view the quota message, the unsanitized content is rendered in their browser context, executing the injected script with the privileges of the viewing user. The vulnerability requires prior authentication and survey management access, but affects any user who subsequently views the compromised quota message. No patch information is currently available.
Affected products
- LimeSurvey Community Edition 7.0.5
Timeline
- 2026-08-26: disclosed