Reflected Cross-Site Scripting Vulnerability in LimeSurvey by LimeSurvey
CVE-2026-63360

7.4HIGH

Key Information:

Vendor

Limesurvey

Status
Limesurvey
Vendor
CVE Published:
26 August 2026

What is CVE-2026-63360?

The LimeSurvey Community Edition is susceptible to an authenticated reflected Cross-Site Scripting vulnerability, specifically in the user activation confirmation endpoint. The action query parameter is inadequately handled and directly reflects into the response, leading to potential exploitation. This flaw allows attackers to inject malicious scripts that can compromise user data and session integrity. Users are encouraged to update to the latest version to mitigate this risk.

Affected Version(s)

LimeSurvey Windows 7.0.5

References

https://fluidattacks.com/advisories/raine
third-party-advisory
https://github.com/LimeSurvey/LimeSurvey
product

CVSS V4

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Miguel GĂłmez
Fluid Attacks' AI SAST Scanner
.