CVE-2026-15973 in LimeSurvey
Summary
by MITRE • 08/27/2026
LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the Survey Menu Entries administration page. An authenticated user with the global settings:read permission can create a survey menu entry containing attacker-controlled data. The value is stored in the surveymenu_entries.data field and later inserted into a single-quoted HTML title attribute without context-appropriate encoding.
This issue affects LimeSurvey: 7.0.5.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/27/2026
The vulnerability identified in LimeSurvey Community Edition version 7.0.5 represents a significant security flaw within the application's survey management interface, specifically located in the Survey Menu Entries administration page. This is classified as a stored cross-site scripting (XSS) vulnerability, which poses a persistent threat to users who interact with compromised menu structures. The root cause of this issue lies in insufficient input validation and output encoding mechanisms when handling data submitted by authenticated users possessing global settings read permissions. When such a user creates or modifies a survey menu entry, the application accepts attacker-controlled payloads without adequate sanitization. These malicious inputs are then persisted within the surveymenu_entries.data field in the backend database, ensuring that the payload remains active until manually removed from the system.
From a technical perspective, the exploitation vector relies on how the stored data is rendered back to the client browser. Upon retrieval, the untrusted input containing script tags or other executable JavaScript code is inserted directly into an HTML title attribute enclosed in single quotes. Because the application fails to apply context-appropriate encoding for this specific HTML attribute context, the browser interprets the injected content as active scripting rather than static text. This lack of proper escaping allows the malicious payload to execute within the security context of the logged-in user's session whenever a victim views or interacts with the affected menu entry. The single-quote enclosure is particularly relevant here, as it suggests that an attacker could potentially break out of the attribute value if additional encoding were not strictly enforced by the browser's parser for certain edge cases, although in this specific instance, the direct insertion into the title attribute suffices for execution when rendered improperly or when combined with other DOM-based triggers.
The operational impact of this vulnerability is substantial due to its stored nature and the relatively low privilege level required for exploitation. An attacker only needs global settings:read permission, which may be granted to various administrative roles depending on the organization's configuration. Once executed, the cross-site scripting attack can lead to session hijacking through cookie theft or token extraction, allowing the adversary to impersonate legitimate users and escalate privileges within the LimeSurvey environment. Furthermore, the attacker can perform actions on behalf of victims, such as creating new surveys, modifying existing ones, or exfiltrating sensitive survey data collected by other users. This compromises the confidentiality, integrity, and availability of the survey platform, potentially leading to significant reputational damage and loss of trust among participants whose personal information might be exposed through manipulated survey results or redirected phishing pages hosted on external domains controlled by the attacker.
This vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific mechanism involves a failure to encode special characters before embedding them in HTML attributes, falling under subcategories like CWE-80 and CWE-83 depending on the exact encoding bypass technique used. In terms of offensive security frameworks, this behavior maps closely to MITRE ATT&CK techniques T1059.007 for JavaScript execution within a browser environment and potentially T1213 if data is exfiltrated via cookies or local storage manipulation. The stored aspect also correlates with persistence mechanisms where malicious content remains in the system until remediated, increasing the window of exposure compared to reflected XSS attacks that require immediate user interaction with a crafted link.
Mitigation strategies must address both immediate patching and long-term defensive coding practices. Administrators should immediately upgrade LimeSurvey Community Edition to version 7.0.6 or any later release where this vulnerability has been patched by the development team. The fix typically involves implementing robust output encoding functions that escape special characters such as single quotes, double quotes, ampersands, and less-than/greater-than signs based on the specific HTML context in which they are rendered. For environments unable to upgrade immediately, web application firewalls can be configured to detect and block requests containing common XSS payloads within survey menu entry fields. Additionally, enforcing strict Content Security Policy headers that restrict script execution sources can mitigate the impact of successful exploitation by preventing inline scripts from running unless explicitly whitelisted. Regular security audits focusing on input validation across all user-facing forms are recommended to prevent similar vulnerabilities in other modules of the application.