CVE-2026-65930— LimeSurvey Community Edition 7.0.5 - Stored XSS in replacement-fields
Quick assessment
Affected
LimeSurvey LimeSurvey
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
LimeSurvey 社区版 7.0.5 存在一个经过身份验证的存储型跨站脚本（XSS）漏洞，位于管理员问题编辑器中用于替换字段的对话框中。该问题影响 LimeSurvey 7.0.5。
Possible ATT&CK Techniques 1 AI
T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-65930
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
LimeSurvey Community Edition 7.0.5 - Stored XSS in replacement-fields
Source: CVE Program / CVE List V5
Vulnerability Description
LimeSurvey Community Edition 7.0.5 contains an authenticated stored cross-site scripting vulnerability in the replacement-fields dialog used by the administrative question editor.This issue affects LimeSurvey: 7.0.5.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| LimeSurvey | LimeSurvey | 7.0.5 | - |
|
II. Public POCs for CVE-2026-65930
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-65930
请登录查看更多情报信息。
Security Blog Posts for CVE-2026-65930 (1)
Same Patch Batch · LimeSurvey · 2026-08-26 · 4 CVEs total
| CVE-2026-15973 | 8.4 HIGH | LimeSurvey 7.0.5 - Stored XSS in Survey Menu Entries |
| CVE-2026-63360 | 7.4 HIGH | LimeSurvey Community Edition 7.0.5 - Reflected XSS in user activation confirmation endpoin |
| CVE-2026-16809 | 7.2 HIGH | LimeSurvey Community Edition 7.0.5 - Stored XSS in quota message rendering |
IV. Related Vulnerabilities
Same product: LimeSurvey
-
CVE-2026-63360
LimeSurvey Community Edition 7.0.5 - Reflected XSS in user a -
CVE-2026-16809
LimeSurvey Community Edition 7.0.5 - Stored XSS in quota mes -
CVE-2026-15973
LimeSurvey 7.0.5 - Stored XSS in Survey Menu Entries -
CVE-2026-18403
LimeSurvey Community Edition 7.0.5 - Authenticated SQL injec -
CVE-2026-63361
LimeSurvey Community Edition 7.0.5 - Reflected XSS in HTML e
Same vendor: LimeSurvey
-
CVE-2026-63360
LimeSurvey Community Edition 7.0.5 - Reflected XSS in user a -
CVE-2026-16809
LimeSurvey Community Edition 7.0.5 - Stored XSS in quota mes -
CVE-2026-15973
LimeSurvey 7.0.5 - Stored XSS in Survey Menu Entries -
CVE-2026-18403
LimeSurvey Community Edition 7.0.5 - Authenticated SQL injec -
CVE-2026-63361
LimeSurvey Community Edition 7.0.5 - Reflected XSS in HTML e
Same weakness: CWE-79
-
CVE-2026-78293
WordPress WP w3all phpBB plugin <= 3.0.6 - Cross Site Script -
CVE-2026-78289
WordPress CozyStay theme <= 1.10.0 - Cross Site Scripting (X -
CVE-2026-78283
WordPress Music Player for WooCommerce plugin <= 1.8.9 - Cro -
CVE-2026-78281
WordPress CP Media Player plugin <= 1.3.0 - Cross Site Scrip -
CVE-2026-78273
WordPress Fluent Boards Pro plugin <= 2.0.11 - Cross Site Sc
V. Comments for CVE-2026-65930
No comments yet