LimeSurvey Community Edition 7.0.5+260623 contains an authenticated reflected Cross-Site Scripting vulnerability in the user activation confirmation… (CVE-2026-63360)

An authenticated reflected Cross-Site Scripting vulnerability exists in LimeSurvey Community Edition 7.0.5+260623 within the user activation confirmation endpoint. Specifically, the 'action' query parameter is copied into the HTTP response and inserted into a hidden input attribute without HTML attribute encoding, allowing an attacker with authenticated access to inject malicious scripts that could be executed in the context of the victim's browser session. This vulnerability is tracked as CVE-2026-63360 and is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Successful exploitation of this vulnerability could allow an authenticated attacker to execute arbitrary scripts in the context of the affected user's browser session. This may lead to session hijacking, unauthorized actions, or other impacts typical of reflected XSS vulnerabilities. However, exploitation requires authentication, limiting the attack surface to users with valid credentials.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should restrict access to trusted authenticated users and consider additional input validation or output encoding on the 'action' parameter if possible. Monitor vendor communications for updates on patches or official mitigations.