A reflected Cross‑Site Scripting (XSS) vulnerability exists in LimeSurvey through the gid parameter in the QuestionCreate module. Because the gid value is not validated, an attacker can embed malicious scripts in a crafted URL. When a logged‑in user opens the URL, the script executes in their browser, potentially allowing the attacker to steal session cookies, hijack the user’s session, or perform other malicious actions within the context of the authenticated session. The weakness is classified as CWE‑79, indicating improper input handling leading to script injection.

LimeSurvey installations running any version earlier than 6.15.11+250909 are affected. No other vendors or products are listed as impacted.

The CVSS base score of 6.1 indicates moderate severity. The EPSS score is below 1 %, and the vulnerability is not listed in CISA’s KEV catalog, suggesting exploitation is unlikely but still possible. The required attack path involves a malicious URL that includes a gid parameter; it specifically targets logged‑in users, so the attacker needs either the user’s credentials or a social‑engineering vector to get the victim to visit the URL. While not highly probable, the impact on confidentiality and integrity for an affected user warrants prompt action.