CVE-2026-15973

Vulnerability Description

LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the Survey Menu Entries administration page. An authenticated user with the global settings:read permission can create a survey menu entry containing attacker-controlled data. The value is stored in the surveymenu_entries.data field and later inserted into a single-quoted HTML title attribute without context-appropriate encoding. This issue affects LimeSurvey: 7.0.5.

Related Weaknesses (CWE)

References

• https://fluidattacks.com/es/advisories/backstreet
• https://github.com/LimeSurvey/LimeSurvey

FAQ

What is CVE-2026-15973?

CVE-2026-15973 is a documented vulnerability. LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the Survey Menu Entries administration page. An authenticated user with the global settings:read permission c...

How severe is CVE-2026-15973?

CVSS scoring is not yet available for CVE-2026-15973. Check NVD for updates.

Is there a patch for CVE-2026-15973?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.