A high-severity cross-site scripting vulnerability in LimeSurvey version 7.0.5 could allow attackers to execute arbitrary scripts in a user's browser, leading to potential session theft or data compromise.

This is a stored or reflected cross-site scripting (XSS) vulnerability (CWE-79). The vulnerability allows an unauthenticated attacker to inject malicious scripts into the application, which are then executed within the context of an unsuspecting user's browser session.

The exploitation of this vulnerability allows for the compromise of user accounts and the potential theft of sensitive survey data. With a CVSS score of 8.5, the impact is high, as the vulnerability could be leveraged to manipulate system settings or perform actions on behalf of authenticated administrators, leading to a broader system compromise.

Immediate Action: As a formal patch may still be in development, users should monitor the official LimeSurvey GitHub repository for updates and apply the fix immediately upon release.

Proactive Monitoring: Monitor application traffic for suspicious script injection patterns in HTTP requests and review administrative audit logs for unauthorized configuration changes.

Compensating Controls: Implement a Content Security Policy (CSP) to restrict the sources from which scripts can be executed, which may mitigate the impact of XSS attacks.

Public Exploit Available: No

Given the availability of a proof-of-concept and the high severity of XSS, organizations should restrict access to the affected LimeSurvey instance until a security update is applied. Ensure that all users are cautioned against clicking untrusted links while using the application.