LimeSurvey Community Edition 7.7.0 has a stored cross-site scripting (XSS) vulnerability in the Central Participants Database blocklist control. An authenticated user with limited import permissions can inject HTML via CSV import, which is then persisted without proper validation. When a participant list is viewed, the injected markup executes in the context of the victim's authenticated session, potentially exposing session data and allowing same-origin requests with the victim's permissions.