CVE-2026-96358
MediumCVSS 4.6Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The Webform module for Drupal is vulnerable to Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. This affects versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
Risk Assessment
An attacker could inject malicious scripts that execute in a user's browser when they visit the page, potentially leading to session hijacking or data theft.
Recommendation
Update the Webform module to a version later than 6.2.12 or 6.3.1, as recommended by the vendor.
Other vulnerabilities in Drupal Webform
See all- CVE-2026-96355Critical
The Webform module for Drupal (versions 0.0.0 to 6.2.12 and 6.3.0 to 6.3.1) is vulnerable to code injection due to improper neutralization of special elements used in a template engine.
- CVE-2026-96398Medium
The Drupal Webform module contains an Incorrect Authorization vulnerability that allows Forceful Browsing. The issue affects versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
- CVE-2026-96373Low
The Drupal Webform module contains an incorrect authorization vulnerability allowing forceful browsing. This issue affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
- CVE-2026-96372Medium
The Drupal Webform module has an insufficient granularity of access control vulnerability, allowing forceful browsing. This issue affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
- CVE-2026-96371Medium
The Drupal Webform module contains a Privilege Defined With Unsafe Actions vulnerability that allows stored XSS. The issue affects versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
- CVE-2026-96370Medium
The Drupal Webform module has an incorrect authorization vulnerability, allowing Server Side Request Forgery (SSRF). This issue affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
- CVE-2026-96369Low
The Drupal Webform module uses browser cache containing sensitive information due to incorrectly configured access control security levels. This issue affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
- CVE-2026-96368Medium
The Drupal Webform module has an improper neutralization of input during web page generation vulnerability, leading to stored Cross-site Scripting (XSS). This issue affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
- CVE-2026-96367Medium
The Webform module for Drupal contains a Privilege Defined With Unsafe Actions vulnerability that allows Stored XSS. This issue affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
- CVE-2026-96366Medium
The Drupal Webform module has an incorrect authorization vulnerability, allowing forceful browsing. This issue affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS