High · 7.4 CVE-2026-92730 EUVD-2026-85521GHSA-vjm5-6j2q-vvc8

LimeSurvey Community Edition 7.0.14 - Reflected XSS in participant CSV import result via invalid attribute column name

Published Sep 23, 2026 · Updated Sep 23, 2026 · Assigned by Fluid Attacks

Description

LimeSurvey Community Edition 7.0.14 contains a reflected cross-site scripting vulnerability on the administrative survey-participant CSV import result page.

Affected products

Vendor	Product	Affected	Fixed
LimeSurvey	LimeSurvey	7.0.14	—

References

https://fluidattacks.com/es/advisories/camisa third-party-advisory
https://github.com/LimeSurvey/LimeSurvey/ product
https://github.com/LimeSurvey/LimeSurvey/commit/0523de7bbb0282af33a0bf9e08a1fc6333ae6851 patch