Quick answers
- Is CVE-2026-92730 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-92730 being exploited in the wild.
- How severe is CVE-2026-92730?
- Informational severity, published 23 September 2026.
- Which products and versions are affected?
- LimeSurvey Community Edition 7.0.14.
- Is there a fix for CVE-2026-92730?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-92730 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-92730?
- Check whether you run LimeSurvey Community Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A reflected XSS vulnerability exists in the CSV import result page where invalid attribute column names are not properly sanitized before being displayed in HTML. An attacker can craft a malicious URL containing JavaScript payload in the column name parameter that executes in the administrator's browser when they visit the import results page. No authentication bypass is required—only that an admin click a attacker-controlled link; the vulnerability is context-dependent on the administrative survey-participant import functionality.
Affected products
- LimeSurvey Community Edition 7.0.14
Timeline
- 2026-09-23: disclosed