CVE-2026-91775 — LimeSurvey Community Edition 7.0.14 - Reflected XSS through unescaped LSS survey-import warnings
LimeSurvey Community Edition 7.0.14 fails to safely encode attacker-controlled content from a crafted .lss survey file when displaying import warnings, resulting in XSS in the a…
Published: 2026-09-23 · CVSS: 7.4 · CVSS 4.0
LimeSurvey Community Edition 7.0.14 fails to safely encode attacker-controlled content from a crafted .lss survey file when displaying import warnings, resulting in XSS in the administrative interface.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7