CVE-2019-16172

CVE-2019-16172 is a stored Cross-Site Scripting (XSS) vulnerability affecting LimeSurvey versions prior to 3.17.14. This flaw allows a low-privileged user to escalate their privileges, potentially to SuperAdmin, by embedding JavaScript in a survey group title that executes upon group deletion. The vulnerability has a CVSS score of 5.4 (Medium), indicating a network-based attack requiring low privileges and user interaction, with potential for limited confidentiality and integrity impact. While not on the KEV catalog or Hot List, an exploit is publicly available on ExploitDB, though there is no evidence of active exploitation, Metasploit modules, or significant community discussion or media coverage.