CVE-2026-63360— LimeSurvey Community Edition 7.0.5 - Reflected XSS in user activation confirmation endpoint
Quick assessment
Affected
LimeSurvey LimeSurvey
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
LimeSurvey 社区版 7.0.5+260623 在用户激活确认端点存在一个经过身份验证的反射型跨站脚本（Reflected Cross-Site Scripting, XSS）漏洞。其中， 查询参数被直接复制到响应中，并插入到一个隐藏输入字段的属性中，但未进行 HTML 属性编码。 该问题影响 LimeSurvey 版本：7.0.5。
Possible ATT&CK Techniques 2 AI
T1190 · Exploit Public-Facing Application T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-63360
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
LimeSurvey Community Edition 7.0.5 - Reflected XSS in user activation confirmation endpoint
Source: CVE Program / CVE List V5
Vulnerability Description
LimeSurvey Community Edition 7.0.5+260623 contains an authenticated reflected Cross-Site Scripting vulnerability in the user activation confirmation endpoint. The action query parameter is copied into the response and inserted into a hidden input attribute without HTML attribute encoding.
This issue affects LimeSurvey: 7.0.5.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| LimeSurvey | LimeSurvey | 7.0.5 | - |
|
II. Public POCs for CVE-2026-63360
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-63360
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-63360 (1)
Same Patch Batch · LimeSurvey · 2026-08-26 · 4 CVEs total
| CVE-2026-15973 | 8.4 HIGH | LimeSurvey 7.0.5 - Stored XSS in Survey Menu Entries |
| CVE-2026-16809 | 7.2 HIGH | LimeSurvey Community Edition 7.0.5 - Stored XSS in quota message rendering |
| CVE-2026-65930 | 4.8 MEDIUM | LimeSurvey Community Edition 7.0.5 - Stored XSS in replacement-fields |
IV. Related Vulnerabilities
Same product: LimeSurvey
-
CVE-2026-16809
LimeSurvey Community Edition 7.0.5 - Stored XSS in quota mes -
CVE-2026-65930
LimeSurvey Community Edition 7.0.5 - Stored XSS in replaceme -
CVE-2026-15973
LimeSurvey 7.0.5 - Stored XSS in Survey Menu Entries -
CVE-2026-18403
LimeSurvey Community Edition 7.0.5 - Authenticated SQL injec -
CVE-2026-63361
LimeSurvey Community Edition 7.0.5 - Reflected XSS in HTML e
Same vendor: LimeSurvey
-
CVE-2026-16809
LimeSurvey Community Edition 7.0.5 - Stored XSS in quota mes -
CVE-2026-65930
LimeSurvey Community Edition 7.0.5 - Stored XSS in replaceme -
CVE-2026-15973
LimeSurvey 7.0.5 - Stored XSS in Survey Menu Entries -
CVE-2026-18403
LimeSurvey Community Edition 7.0.5 - Authenticated SQL injec -
CVE-2026-63361
LimeSurvey Community Edition 7.0.5 - Reflected XSS in HTML e
Same weakness: CWE-79
-
CVE-2026-78293
WordPress WP w3all phpBB plugin <= 3.0.6 - Cross Site Script -
CVE-2026-78289
WordPress CozyStay theme <= 1.10.0 - Cross Site Scripting (X -
CVE-2026-78283
WordPress Music Player for WooCommerce plugin <= 1.8.9 - Cro -
CVE-2026-78281
WordPress CP Media Player plugin <= 1.3.0 - Cross Site Scrip -
CVE-2026-78273
WordPress Fluent Boards Pro plugin <= 2.0.11 - Cross Site Sc
V. Comments for CVE-2026-63360
No comments yet