CVE-2026-65930: LimeSurvey Community Edition 7.0.5 - Stored XSS in replacement-fields
Published Aug 26, 2026
·Updated
LimeSurvey Community Edition 7.0.5 contains an authenticated stored cross-site scripting vulnerability in the replacement-fields dialog used by the administrative question editor.This issue affects LimeSurvey: 7.0.5.
Affected Software
1 affected component
Limesurvey LimeSurvey Community Edition=7.0.5
Event History
Aug 26, 2026
CVE Published
via MITRE·09:24 PM
Data Sourced
via MITRE·09:24 PM
DescriptionWeakness
Data Sourced
via NVD·10:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An attacker needs to be authenticated and able to use the replacement-fields dialog in the administrative question editor.
2
What is required for exploitation?
The attacker must submit crafted content through the replacement-fields dialog so that it is stored and later rendered in a browser.
3
How can I determine whether my deployment is affected?
The issue is reported to affect LimeSurvey Community Edition version 7.0.5. Check the deployed LimeSurvey version and whether administrative users can access the question editor's replacement-fields dialog.