An authenticated user with the Surveys: create permission on LimeSurvey Community Edition 7.4.0 can input a JavaScript‑breaking value into the date_min attribute of a Date/Time question. When the question is later rendered for any user, LimeSurvey inserts this value into a single‑quoted inline JavaScript literal without proper context encoding, allowing arbitrary script execution. The vulnerability therefore enables a stored cross‑site scripting attack that can compromise confidentiality, integrity, and availability of user sessions and data.

LimeSurvey Community Edition 7.4.0 on Linux, macOS, and Windows devices is affected. No other versions are mentioned, and only the 7.4.0 release contains the flaw.

The CVSS score of 7.2 indicates a moderate severity. No EPSS score is provided, and the issue is not listed in CISA KEV catalog. The attack requires an authenticated user who can create surveys, making the initial foothold more limited than a remote unauthenticated exploit. Once the malicious question is accessed, any user viewing the survey is exposed to the injected script, potentially leading to credential theft or other malicious actions.