LimeSurvey Community Edition 7.0.5 and later build 260623 includes an authenticated reflected Cross‑Site Scripting flaw in the user activation confirmation endpoint. The value supplied in the action query parameter is inserted unencoded into a hidden input attribute of the page. Because the input is not HTML‑attribute encoded, malicious JavaScript can be injected and executed in the victim’s browser whenever the URL is processed. The direct impact is the ability for an attacker who can authenticate to the application to run arbitrary client‑side code in the context of that user’s session. The likely downstream consequences of that execution, such as session hijacking, phishing or data exfiltration, are inferred and not explicitly documented in the CVE description.

All installations of LimeSurvey Community Edition 7.0.5 running on Linux, macOS or Windows operating systems are affected, including the specific build 260623. The vulnerability does not affect other product editions or later versions that contain the patch.

The vulnerability receives a CVSS score of 7.4, reflecting a moderate to high severity. The EPSS score is not available, so the current probability of exploitation is unknown. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires an authenticated session in the application; once logged in, the attacker can request the activation confirmation endpoint with a malicious action value, triggering the reflected XSS. The likely attack vector is the authenticated use of a crafted URL that includes the malicious action parameter. Because the flaw is reflected and occurs in a hidden input, any attack that succeeds would run arbitrary JavaScript, enabling theft of session cookies, manipulation of the user interface or other client‑side behaviors.