CVE-2026-63361
HighCVSS 8.5Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
LimeSurvey Community Edition 7.0.5 contains an authenticated reflected cross-site scripting vulnerability in the HTML editor popup endpoint. The text and name query parameters are passed through a blacklist sanitizer and then rendered without context-appropriate output encoding.
Risk Assessment
Risk of malicious script execution in the user's browser, potentially leading to session theft or other attacks.
Recommendation
It is recommended to upgrade LimeSurvey to the latest version and implement proper output encoding in the application.
Original NVD description (English source)
LimeSurvey Community Edition 7.0.5 contains an authenticated reflected cross-site scripting vulnerability in the HTML editor popup endpoint. The text and name query parameters are passed through a blacklist sanitizer and then rendered without context-appropriate output encoding.