This vulnerability in LimeSurvey affects the Alert Widget's message component, where lack of proper input validation and output encoding enables a remote attacker to perform Cross Site Scripting (CWE-79). The flaw allows execution of arbitrary code in the context of the affected web application. The CVSS vector indicates the attack can be performed remotely without privileges, requires user interaction, and impacts confidentiality and integrity with no impact on availability. The affected versions are all versions before 6.5.0+240319, although this specific version is not explicitly listed in the affectedVersions field.

Successful exploitation could allow an attacker to execute arbitrary script code in the victim's browser, potentially leading to information disclosure or manipulation of data within the affected LimeSurvey instance. The vulnerability impacts confidentiality and integrity but does not affect availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor LimeSurvey's official channels for updates. Until a patch is available, consider restricting access to the Alert Widget or applying input filtering controls if possible.