CVE-2026-63360: LimeSurvey Community Edition 7.0.5 - Reflected XSS in user activation confirmation endpoint
LimeSurvey Community Edition 7.0.5+260623 contains an authenticated reflected Cross-Site Scripting vulnerability in the user activation confirmation endpoint. The action query parameter is copied into the response and inserted into a hidden input attribute without HTML attribute encoding.
This issue affects LimeSurvey: 7.0.5.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The issue is authenticated, so the attacker needs access to a valid LimeSurvey Community Edition account and must be able to cause a request to the user activation confirmation endpoint with a crafted action query parameter.
Which deployments are known to be affected?
The affected version identified in the available data is LimeSurvey Community Edition 7.0.5+260623, corresponding to LimeSurvey 7.0.5. The data does not state whether other versions or configurations are affected.
What input should be investigated for evidence of exposure?
Review requests to the user activation confirmation endpoint for suspicious or unexpected values in the action query parameter. This parameter is reflected into a hidden input attribute without HTML attribute encoding.