The username and password field on the LimeSurvey login page allow the user's browser a client-side storage of username and password, whereby the data during future visits to the web application is automatically transferred to the corresponding form field.
This may - under certain circumstances - facilitate attacks to take over third-party user accounts in which the victim's browser can be accessed and the information stored there can then be used to log on to the web application.
Together with a cross-site scripting vulnerability, client-side password storage represents an increased risk, as it is possible to read out the stored login data via JavaScript.
In spite of the fact that modern web browsers save the login data it is recommended to provide the affected input fields and the entire form element with the attribute "autocomplete=off".