LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the survey quota creation workflow. (CVE-2026-16809)

CVE-2026-16809 is a stored cross-site scripting vulnerability in LimeSurvey Community Edition 7.0.5. The flaw exists in the survey quota creation workflow, where an authenticated low-privileged user capable of creating and managing their own survey can store malicious JavaScript in a quota message. This stored script could be executed in the browsers of users who view the affected quota message, potentially leading to session hijacking or other script-based attacks. The vulnerability is categorized under CWE-79 (Improper Neutralization of Input During Web Page Generation). No official patch or fix has been indicated in the available data.

The vulnerability allows an authenticated low-privileged user to inject and store malicious JavaScript code that executes in the context of other users viewing the quota message. This can lead to cross-site scripting attacks, potentially compromising user sessions or enabling unauthorized actions within the application. The impact is rated as high severity based on the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict survey creation and management permissions to trusted users only and consider monitoring for suspicious quota messages. Avoid exposing quota messages to untrusted users where possible.