@DenisChenu, any thoughts on how to best deal with this?

1. There are no real issue with LimeSurvey since simple user can not add $('[data-toggle="switch"]').bootstrapSwitch() and admin user can add alert('XSS')
2. You loose something moveing fro html to text

Globally : i don't understand fixing a JS script where user must set a specific JS . If he can set JS : he can just add XSS how he want.

Still a good idea to move to https://getbootstrap.com/docs/5.0/forms/checks-radios/#switches and remove bootstrapSwitch
Or just use a checkbox … (or dropdown or radio)

@DenisChenu: I second this. This is the reason why I hate these automated pentests. They often show issues which are no real use case at all. But if the company has a strict policy, they may not be allowed to use Limesurvey due to such questionable findings.

My real opinion :

Or just use a checkbox … (or dropdown or radio)

Simple and clean, 1. No need JS, 2. A11Y proof, 3. Stability proof,

There are 4. Can use helper of browser, 5. Can use specific theme by user choice, except we force some update here (not always a good idea)

Bootstrap 5/6 supports .form-switch which should be a possible alternative to get rid of this library.
https://getbootstrap.com/docs/5.3/forms/checks-radios/#switches

Or just a checkbox ;)