The vulnerability in LimeSurvey Community Edition 7.0.5 is an authenticated reflected cross-site scripting (CWE-79) issue located in the HTML editor popup endpoint. Specifically, the text and name query parameters are processed through a blacklist sanitizer but are subsequently rendered without applying context-appropriate output encoding, enabling injection of malicious scripts. This vulnerability requires authentication to exploit and affects the specified version 7.0.5. There is no patch or vendor advisory provided to confirm remediation status.

An authenticated attacker can exploit this reflected XSS vulnerability to execute arbitrary scripts in the context of the victim's browser session within LimeSurvey. This could lead to session hijacking, unauthorized actions, or other malicious activities depending on the victim's privileges and interaction with the application. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider limiting access to trusted authenticated users and monitor for suspicious activity related to the HTML editor popup endpoint. Avoid relying solely on blacklist sanitization and implement context-appropriate output encoding as a best practice once a fix is available.