Description
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
Published: 2026-10-22
Score: 4.6 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Stored Cross‑site Scripting
Action: Patch
AI Analysis

Impact

The vulnerability is an improper neutralization of input that allows malicious users to store JavaScript in Drupal Webform submissions. The stored script is rendered when users view the content, enabling execution of arbitrary client‑side code. The weakness is classified as CWE‑79.

Affected Systems

Drupal Webform module versions 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1 are affected. Systems using any of these releases should verify the exact module version and apply the latest update.

Risk and Exploitability

The CVSS score is 4.6, the EPSS score is less than 1%, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it appears that exploitation requires a user to view the stored form data, which is typical for stored cross‑site scripting attacks. The risk is moderate, and the likelihood of exploitation is low according to the EPSS metric.

Generated by OpenCVE AI on October 22, 2026 at 16:56 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Drupal Webform module to a release that includes the fix (at least version 6.3.2).
  • Apply proper output encoding or sanitization to any user input stored by the module, consistent with CWE‑79 mitigation techniques.
  • If an upgrade cannot be performed immediately, restrict public access to forms or stored submissions until the fix is applied to reduce the opportunity for malicious payloads to be rendered.

Generated by OpenCVE AI on October 22, 2026 at 16:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://www.drupal.org/sa-contrib-2026-172 cve-icon cve-icon
History

Tue, 10 Nov 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 4.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N'}

Thu, 22 Oct 2026 11:00:00 +0000

Type Values Removed Values Added
First Time appeared Drupal
Drupal webform
Vendors & Products Drupal
Drupal webform

Thu, 22 Oct 2026 01:45:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
Title Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-172
Weaknesses CWE-79
References

Subscriptions

Drupal Webform
cve-icon MITRE

Status: PUBLISHED

Assigner: drupal

Published:

Updated: 2026-10-22T14:55:52.291Z

Reserved: 2026-09-23T01:32:48.994Z

Link: CVE-2026-96357

cve-icon Vulnrichment

Updated: 2026-10-22T14:55:42.499Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-22T02:17:05.667

Modified: 2026-10-22T16:54:17.390

Link: CVE-2026-96357

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T17:00:10Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')