CVE-2026-102626

Name of the Vulnerable Software and Affected Versions LimeSurvey Community Edition version 7.4.0

Description An authenticated user with global Surveys: create permissions can store a value that breaks JavaScript execution within the date min attribute of a Date/Time question. The issue occurs because the software inserts this stored value into a single-quoted inline JavaScript literal without applying proper JavaScript-context encoding, leading to stored Cross-Site Scripting (XSS), where malicious scripts are permanently stored on the server and executed in the browser of other users who render the affected question.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.