CVE-2026-16809

Received Received - Intake

Stored XSS in LimeSurvey Community Edition

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: Fluid Attacks

Description

LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the survey quota creation workflow. An authenticated low-privileged user who can create and manage their own survey can store malicious JavaScript in a quota message. This issue affects LimeSurvey: 7.0.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-08-26

Generated

2026-08-27

AI Q&A

2026-08-27

EPSS Evaluated

N/A

NVD

CVE-2026-16809

EUVD

EUVD-2026-66771

Affected Vendors & Products

Vendor	Product	Version / Range
limesurvey	community_edition	7.0.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

LimeSurvey Community Edition 7.0.5 has a stored cross-site scripting (XSS) vulnerability in the survey quota creation process. An authenticated user with low privileges can inject malicious JavaScript into a quota message, which is then stored and executed when viewed by other users.

Detection Guidance

To detect this vulnerability, inspect LimeSurvey 7.0.5 instances for stored XSS in survey quota messages. Check for malicious JavaScript payloads in quota settings. No specific commands are provided in the context.

Impact Analysis

This vulnerability allows attackers to execute arbitrary JavaScript in the context of other users' browsers. This could lead to session hijacking, theft of sensitive data, or unauthorized actions performed on behalf of the victim.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations using affected versions may face compliance violations and potential legal consequences.

Mitigation Strategies

Upgrade LimeSurvey to a version later than 7.0.5 where this vulnerability has been patched. Restrict low-privileged users from creating or managing surveys until the update is applied.

Hi! I’m here to help you understand CVE-2026-16809. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70