CVE-2026-15973: LimeSurvey 7.0.5 - Stored XSS in Survey Menu Entries
LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the Survey Menu Entries administration page. An authenticated user with the global settings:read permission can create a survey menu entry containing attacker-controlled data. The value is stored in the surveymenuentries.data field and later inserted into a single-quoted HTML title attribute without context-appropriate encoding.
This issue affects LimeSurvey: 7.0.5.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
An authenticated user must have the global settings:read permission. That permission is sufficient to create a malicious survey menu entry.
Where is the malicious content stored and when does it execute?
The attacker-controlled value is stored in the surveymenu_entries.data field. It is later rendered inside a single-quoted HTML title attribute without context-appropriate encoding, creating a stored XSS condition.
Are deployments running LimeSurvey Community Edition 7.0.5 affected by default?
The available information identifies LimeSurvey Community Edition 7.0.5 as affected, but does not state whether a default configuration exposes the vulnerable Survey Menu Entries administration functionality.