WS-2023-0073
Published:May 15, 2026
Updated:May 15, 2026
A Stored Cross-Site Scripting (XSS) vulnerability was found in limesurvey/limesurvey prior to 5.6.6. An attacker can execute any javascript code in victim account.
Affected Packages
limesurvey/limesurvey (PHP):
Affected version(s) >=5.0.1+210532 <5.3.7+220328Fix Suggestion:
Update to version 5.3.7+220328limesurvey/limesurvey (PHP):
Affected version(s) >=4.4.0-RC1+201223 <dev-snyk-upgrade-2721d74513ebeb6a032896d25085b820Fix Suggestion:
Update to version dev-snyk-upgrade-2721d74513ebeb6a032896d25085b820limesurvey/limesurvey (PHP):
Affected version(s) =dev-add-app-params-to-twig <dev-add-before-get-template-eventFix Suggestion:
Update to version dev-add-before-get-template-eventlimesurvey/limesurvey (PHP):
Affected version(s) =dev-inject-questionattributes <dev-install-command-rpcFix Suggestion:
Update to version dev-install-command-rpclimesurvey/limesurvey (PHP):
Affected version(s) >=dev-dependabot/npm_and_yarn/assets/packages/adminbasics/terser-5.14.2 <dev-dependabot/npm_and_yarn/assets/packages/lstutorial/terser-5.14.2Fix Suggestion:
Update to version dev-dependabot/npm_and_yarn/assets/packages/lstutorial/terser-5.14.2limesurvey/limesurvey (PHP):
Affected version(s) >=dev-dependabot/npm_and_yarn/assets/packages/questions/upload/loader-utils-2.0.3 <2.2.5Fix Suggestion:
Update to version 2.2.5limesurvey/limesurvey (PHP):
Affected version(s) >=dev-kill-travis <dev-master-innodbFix Suggestion:
Update to version dev-master-innodblimesurvey/limesurvey (PHP):
Affected version(s) >=5.3.27+220725 <5.6.6+230220Fix Suggestion:
Update to version 5.6.6+230220limesurvey/limesurvey (PHP):
Affected version(s) =dev-fix-qngroup-phpdoc <dev-fix-relations-20230411Fix Suggestion:
Update to version dev-fix-relations-20230411limesurvey/limesurvey (PHP):
Affected version(s) >=5.3.8+220404 <5.3.26+220720Fix Suggestion:
Update to version 5.3.26+220720limesurvey/limesurvey (PHP):
Affected version(s) =dev-on-update-values-v4 <dev-snyk-upgrade-a21e4d557f0b34aa787a93be9924af13Fix Suggestion:
Update to version dev-snyk-upgrade-a21e4d557f0b34aa787a93be9924af13limesurvey/limesurvey (PHP):
Affected version(s) =dev-dependabot/npm_and_yarn/assets/packages/questions/upload/terser-5.14.2 <6.0.0+230405Fix Suggestion:
Update to version 6.0.0+230405limesurvey/limesurvey (PHP):
Affected version(s) >=dev-dependabot/npm_and_yarn/assets/packages/adminbasics/loader-utils-2.0.3 <dev-dependabot/npm_and_yarn/assets/packages/lstutorial/loader-utils-2.0.3Fix Suggestion:
Update to version dev-dependabot/npm_and_yarn/assets/packages/lstutorial/loader-utils-2.0.3limesurvey/limesurvey (PHP):
Affected version(s) =dev-dependabot/npm_and_yarn/assets/packages/questions/timer/loader-utils-1.4.2 <dev-detached2Fix Suggestion:
Update to version dev-detached2Related Resources (1)
Do you need more information?
Contact UsCVSS v4
Base Score:
4.8
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
HIGH
User Interaction
PASSIVE
Vulnerable System Confidentiality
LOW
Vulnerable System Integrity
LOW
Vulnerable System Availability
LOW
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
4.3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
LOW
Integrity
LOW
Availability
LOW