LimeSurvey Community Edition 7.0.5 contains an authenticated stored cross-site scripting vulnerability in the replacement-fields dialog used by the… (CVE-2026-65930)

An authenticated stored cross-site scripting vulnerability exists in LimeSurvey Community Edition 7.0.5 within the replacement-fields dialog of the administrative question editor. This flaw allows an attacker with authenticated access and limited privileges to inject malicious scripts that persist and execute when viewed by other users or administrators. The vulnerability is classified under CWE-79 and has a moderate severity rating. No known exploits in the wild have been reported, and no patch or fix information is currently available.

The vulnerability enables an authenticated attacker with limited privileges to perform stored cross-site scripting attacks, potentially leading to script execution in the context of other users or administrators. This can result in session hijacking, unauthorized actions, or data exposure within the LimeSurvey application. However, exploitation requires authentication and user interaction, limiting the scope and impact compared to unauthenticated vulnerabilities.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit user privileges to trusted users only and monitor for suspicious activity related to the replacement-fields dialog. Avoid granting unnecessary administrative access to reduce risk.