A Stored Cross-Site Scripting vulnerability exists in survey administrator name in limesurvey/limesurvey prior to 5.6.6. The administrator name field in Survey settings has a Stored Cross-Site scripting vulnerability as it does not sanitize the user input administrator name. A user can enter the javascript payload "><script>alert(document.cookie)</script> in the Administrator name field and the XSS executes in the authenticated user's context as well as on the survey error page.