Reflected Cross-Site Scripting Vulnerability in LimeSurvey Community Edition
CVE-2026-92730

7.4HIGH

Key Information:

Vendor: Limesurvey
Status: Limesurvey
Vendor: CVE Published:; 23 September 2026

What is CVE-2026-92730?

The LimeSurvey Community Edition version 7.0.14 is susceptible to a reflected cross-site scripting vulnerability found on the administrative survey-participant CSV import result page. This flaw could allow an attacker to inject malicious scripts into web pages viewed by other users, potentially compromising sensitive information or executing unauthorized actions within the application. Implementing the latest patches is crucial for safeguarding against this vulnerability and ensuring robust web application security.

Affected Version(s)

LimeSurvey Windows 7.0.14

References

https://fluidattacks.com/es/advisories/camisa

third-party-advisory

https://github.com/LimeSurvey/LimeSurvey/

product

https://github.com/LimeSurvey/LimeSurvey/commit/0523de7bb...

patch

CVSS V4

Score:

7.4

Severity:

HIGH

Confidentiality:

High

Integrity:

High

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Attack Required:

Physical

Privileges Required:

Undefined

User Interaction:

Unknown

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Sep 23, 2026
Vulnerability Reserved
Sep 16, 2026

Credit

Miguel Gómez

CVE-2026-92730 Data

JSON