An authenticated user can trigger a reflected cross‑site scripting vulnerability through the HTML editor popup in LimeSurvey Community Edition. The attacker supplies malicious data via the text and name query parameters, which bypass a blacklist sanitizer and are rendered without adequate encoding, allowing arbitrary script execution in the context of the logged‑in user. This can lead to session hijacking, data theft, and defacement of the survey interface.

LimeSurvey Community Edition version 7.0.5 on Linux, macOS, and Windows is affected. The vulnerability is present in the HTML editor popup endpoint and impacts all installations that use this component without applying the latest patch.

The CVSS score of 8.5 classifies it as High severity. Although no EPSS score is published, the attack requires only authenticated access—information readily available to administrators or users with moderator privileges—making exploitation straightforward. The vulnerability is not listed in CISA’s KEV catalog, but its impact justifies immediate attention. Attackers can craft a malicious URL or embed the payload into survey content to gain execution rights within the authenticated session.