The vulnerability is a cross‑site scripting flaw present in LimeSurvey starting at version 6.15.20+251021. Malicious input supplied to the Box[title] and box[url] parameters can be rendered unfiltered, enabling an attacker to inject arbitrary client‑side code that runs in the browser of users visiting the affected page. Such code execution may lead to the theft of user credentials, session hijacking, or further exploitation of backend services if additional weaknesses exist. The weakness maps to CWE‑79 and sits at a moderate severity level with a CVSS score of 6.1.

LimeSurvey users running version 6.15.20+251021 are affected. No other products or vendors are currently listed. The issue is tied to the Box module that accepts title and URL fields from administrators or content editors.

Exploit feasibility requires that an attacker can provide malicious input to the box[title] or box[url] fields, which is achievable remotely if the administrator interface is accessible or if the parameters are exposed via a public‑facing API. Although no EPSS score is available, the CVSS score of 6.1 indicates a moderate risk, and the vulnerability is not yet recorded in the CISA Known Exploited Vulnerabilities catalog. If abused, the impact could be persistent client‑side compromise for all users who view the malicious content.