LimeSurvey Community Edition 7.0.5 contains an authenticated reflected cross-site scripting (XSS) vulnerability in the HTML editor popup endpoint. The vulnerability arises because the text and name query parameters are filtered by a blacklist sanitizer but then rendered without proper context-appropriate output encoding. This flaw allows an authenticated attacker to inject malicious scripts that could execute in the context of the affected application.