CVE Tools
Track your stack

Limesurvey

97 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Limesurvey, a product in the web cms plugins space. Use it to gauge the current risk picture and drill into individual advisories.

Limesurvey CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Limesurvey CVEs per month
MonthCVEs
2024-110
2024-120
2025-010
2025-020
2025-030
2025-040
2025-050
2025-060
2025-071
2025-082
2025-090
2025-100
2025-113
2025-120
2026-011
2026-020
2026-032
2026-042
2026-050
2026-062
2026-071
2026-087
2026-093
2026-101

Severity

How the 97 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical1012%
  • High2226%
  • Medium4958%
  • Low45%

Latest CVEs

The 15 most recently published vulnerabilities affecting Limesurvey.

  1. CVE-2026-102626LimeSurvey Community Edition 7.4.0 - Stored XSS through the Date/Time date_min question attribute—
  2. CVE-2026-97685LimeSurvey Community Edition 7.3.0 - Cross-survey object authorization bypass in REST survey patch operations—
  3. CVE-2026-92730LimeSurvey Community Edition 7.0.14 - Reflected XSS in participant CSV import result via invalid attribute column name—
  4. CVE-2026-91775LimeSurvey Community Edition 7.0.14 - Reflected XSS through unescaped LSS survey-import warnings—
  5. CVE-2026-65931LimeSurvey Community Edition 7.0.5 - Improper authorization in survey menu entry creation endpoint—
  6. CVE-2026-63360LimeSurvey Community Edition 7.0.5 - Reflected XSS in user activation confirmation endpoint—
  7. CVE-2026-16809LimeSurvey Community Edition 7.0.5 - Stored XSS in quota message rendering—
  8. CVE-2026-65930LimeSurvey Community Edition 7.0.5 - Stored XSS in replacement-fields—
  9. CVE-2026-15973LimeSurvey 7.0.5 - Stored XSS in Survey Menu Entries—
  10. CVE-2026-18403LimeSurvey Community Edition 7.0.5 - Authenticated SQL injection in CPDB—
  11. CVE-2026-63361LimeSurvey Community Edition 7.0.5 - Reflected XSS in HTML editor popup—
  12. CVE-2026-63107LimeSurvey SSRF via REST API Survey Template Host Header7.7
  13. CVE-2026-50636LimeSurvey RemoteControl invite_participants/remind_participants SQL Injection8.8
  14. CVE-2026-50635LimeSurvey Password Reset Host Header Injection Discloses Reset Token8.8
  15. CVE-2025-70797Cross Site Scripting vulnerability in Limesurvey v.6.15.20+251021 allows a remote attacker to execute arbitrary code via the Box[title] and box[url] parameters.6.1

Product grouping is registry-driven, with AI assist and human review. How it works