LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the Survey Menu Entries administration page. (CVE-2026-15973)

The vulnerability in LimeSurvey Community Edition 7.0.5 is a stored cross-site scripting (CWE-79) issue located in the Survey Menu Entries administration page. Authenticated users with global settings:read permission can create survey menu entries containing malicious data. This data is stored in the surveymenu_entries.data field and inserted into a single-quoted HTML title attribute without context-appropriate encoding, enabling stored XSS attacks. The vulnerability affects version 7.0.5 specifically. There is no indication of known exploits in the wild or available patches at this time.

An attacker with authenticated access and global settings:read permission can inject malicious scripts that are stored and executed in the context of the administration interface. This can lead to session hijacking, privilege escalation, or other malicious actions within the LimeSurvey administration environment. The vulnerability is rated as high severity due to the potential impact on administrative users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to users with global settings:read permission and apply strict input validation or sanitization on survey menu entries if possible.