Threats affecting pkg:github/LimeSurvey Community Edition

LimeSurvey Community Edition versions 3.0.0 through 7.7.0 contain a stored cross-site scripting (XSS) vulnerability in the Central Participants Database blocklist control. An authenticated user with global participantpanel:import permission can import a CSV file with participant_id values containing HTML, which are stored without validation. When a CPDB editor views the participant list, the application inserts these values into ButtonGroupWidget attributes without HTML encoding, allowing execution of attacker-controlled markup in the victim's authenticated session. This can lead to unauthorized access to session data and execution of same-origin requests with the victim's permissions.