CVE-2026-102626 LimeSurvey Community Edition 7.4.0 - Stored XSS through the Date/Time date_min question attribute

An authenticated LimeSurvey Community Edition 7.4.0 user with the global Surveys: create permission can store a JavaScript-breaking value in the datemin attribute of a Date/Time question. When another user renders the affected question, LimeSurvey inserts the stored value into a single-quoted...

CVE-2026-102626

LimeSurvey Community Edition 7.4.0 is vulnerable to a Stored XSS flaw. An authenticated user with the global Surveys: create permission can inject a JavaScript-breaking value into the date_min attribute of a Date/Time question. Because the application fails to perform JavaScript-context encoding ...