The issue exists in LimeSurvey Community Edition 7.0.14, where content from a specially crafted .lss survey file is not properly encoded before being displayed in an import warning page. This allows an attacker to inject malicious JavaScript that executes in the browser of a user who views the warning in the admin interface, resulting in a reflected cross‑site scripting flaw (CWE‑79). Because the code runs with the privileges of the administrative session, an attacker could hijack the session, steal credentials, or otherwise compromise survey data.

The vulnerability affects installations of LimeSurvey Community Edition 7.0.14 on Linux, macOS, and Windows operating systems. Any administrator who uses the web interface to import a .lss survey file is susceptible when that file contains malicious content.

With a CVSS score of 7.4 the issue is considered high severity, and the EPSS score of 0.0038 (<1%) indicates a very low likelihood of exploitation; the vulnerability is not included in the CISA KEV catalog. Exploitation requires the attacker to supply a malicious .lss file and trigger the import failure, thereby catching an administrative session. Successful exploitation allows the attacker to run arbitrary JavaScript, potentially leading to session hijacking, credential theft, or further compromise of the survey data.