CVE-2026-102626CWE-79cross-site-scripting

CVE-2026-102626

published October 2, 2026

CVSS
7.2
EPSS
0%
Percentile
18.0
In the wild
Unconfirmed
What it is

An authenticated LimeSurvey Community Edition 7.4.0 user with the global Surveys: create permission can store a JavaScript-breaking value in the date_min attribute of a Date/Time question. When another user renders the affected question, LimeSurvey inserts the stored value into a single-quoted inline JavaScript literal without JavaScript-context encoding.

The record
Technical detail
CVSS
7.2 · NONE
CVSS v4.0
7.2 · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N
EPSS
0.00269 · 18.0th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-10-02T22:16Z
References (3)
https://fluidattacks.com/advisories/golden · [email protected]https://github.com/LimeSurvey/LimeSurvey/ · [email protected]https://github.com/LimeSurvey/LimeSurvey/commit/32e54f14f0b4ddc2d8144daaabf7e23c3bbfb8e8 · [email protected]
EPSS history
Timeline
  • 04 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 02 OCT 17:16Z
    LimeSurvey Community Edition 7.4.0 - Stored XSS through the Date/Time date_min question attribute
    cvelistv5