CVE-2026-15973

Received Received - Intake

Stored XSS in LimeSurvey Community Edition

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: Fluid Attacks

Description

LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the Survey Menu Entries administration page. An authenticated user with the global settings:read permission can create a survey menu entry containing attacker-controlled data. The value is stored in the surveymenu_entries.data field and later inserted into a single-quoted HTML title attribute without context-appropriate encoding. This issue affects LimeSurvey: 7.0.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-08-26

Generated

2026-08-27

AI Q&A

2026-08-27

EPSS Evaluated

N/A

NVD

CVE-2026-15973

Affected Vendors & Products

Vendor	Product	Version / Range
limesurvey	community_edition	7.0.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

LimeSurvey Community Edition 7.0.5 has a stored cross-site scripting (XSS) vulnerability in the Survey Menu Entries administration page. An authenticated user with specific permissions can inject malicious scripts into a survey menu entry. The injected data is stored in the database and later rendered unsafely in a single-quoted HTML title attribute without proper encoding.

Detection Guidance

To detect this vulnerability, inspect LimeSurvey installations for version 7.0.5. Check the Survey Menu Entries administration page for entries containing JavaScript or HTML code in the data field. Review the surveymenu_entries.data field in the database for unencoded or suspicious payloads.

Impact Analysis

This vulnerability allows attackers to execute arbitrary JavaScript in the context of a victim's browser when they view the affected page. This could lead to session hijacking, defacement of the application, or theft of sensitive data like cookies or credentials.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's integrity and confidentiality principles. For HIPAA, it may expose protected health information, risking breaches of security rules and unauthorized disclosures.

Mitigation Strategies

Upgrade LimeSurvey to a version later than 7.0.5 where this vulnerability has been patched. Review survey menu entries for suspicious content and remove any unauthorized entries. Restrict global settings:read permissions to trusted users only.

Hi! I’m here to help you understand CVE-2026-15973. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70