CVE-2026-118560
Low risk· EPSS 5%Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The Commerce Stripe module for Drupal contains a Cross-Site Scripting (XSS) vulnerability caused by improper neutralization of input during web page generation. The issue affects versions from 2.0.0 to 2.2.3.
Risk Assessment
An attacker could inject a malicious script that executes in the user's browser, enabling session or payment data theft. This may undermine trust in the payment process.
Recommendation
Update the Commerce Stripe module to a version later than 2.2.3. Additionally, consider deploying a Content-Security-Policy header to limit the impact of XSS.
Other vulnerabilities in Drupal Commerce Stripe
See all- CVE-2026-118559Low risk· EPSS 1%
The Drupal Commerce Stripe module contains an improper verification of cryptographic signature vulnerability, allowing signature spoofing. This issue affects versions from 0.0.0 to 1.4 and from 2.0.0 to 2.2.3.
- CVE-2026-118558Low risk· EPSS 1%
The Drupal Commerce Stripe module is vulnerable to Cross-Site Request Forgery (CSRF), which can force unwanted actions on behalf of a logged-in user. This issue affects versions from 2.0.0 to 2.2.3.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Commerce Stripe allows Cross-Site Scripting (XSS). This issue affects Commerce Stripe versions: from 2.0.0 to 2.2.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS