Executive brief
LimeSurvey Community Edition is an open-source survey platform used to create and distribute online questionnaires. An authenticated user can inject malicious code through the user activation confirmation endpoint, which could allow them to steal session cookies or credentials from other users who click a crafted link, compromising account security and survey data integrity.
Technical details
This is a reflected Cross-Site Scripting (XSS) vulnerability in the user activation confirmation endpoint of LimeSurvey 7.0.5. The action query parameter is copied directly into the HTTP response and inserted into a hidden input attribute without proper HTML attribute encoding, allowing an attacker to break out of the attribute context and inject arbitrary JavaScript. The vulnerability requires authentication and user interaction (victim must click a malicious link), but allows an attacker to execute code in the victim's browser with their privileges, potentially leading to session hijacking or credential theft.
Affected products
- LimeSurvey Community Edition 7.0.5
Timeline
- 2026-08-26: disclosed