CVE-2026-96363
Low risk· EPSS 8%Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
Risk Assessment
An attacker can inject a malicious script that executes in the browsers of users viewing forms, potentially leading to session theft or actions on behalf of the victim. The risk applies to sites running a vulnerable version of the Webform module.
Recommendation
Update the Webform module to a version later than 6.2.12 or 6.3.1 that contains the fix.
Other vulnerabilities in Drupal Webform
See all- CVE-2026-96355Critical
The Webform module for Drupal (versions 0.0.0 to 6.2.12 and 6.3.0 to 6.3.1) is vulnerable to code injection due to improper neutralization of special elements used in a template engine.
- CVE-2026-96398Medium
The Drupal Webform module contains an Incorrect Authorization vulnerability that allows Forceful Browsing. The issue affects versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
- CVE-2026-96373Low
The Drupal Webform module contains an incorrect authorization vulnerability allowing forceful browsing. This issue affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
- CVE-2026-96372Medium
The Drupal Webform module has an insufficient granularity of access control vulnerability, allowing forceful browsing. This issue affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
- CVE-2026-96371Medium
The Drupal Webform module contains a Privilege Defined With Unsafe Actions vulnerability that allows stored XSS. The issue affects versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
- CVE-2026-96370Medium
The Drupal Webform module has an incorrect authorization vulnerability, allowing Server Side Request Forgery (SSRF). This issue affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
- CVE-2026-96369Low
The Drupal Webform module uses browser cache containing sensitive information due to incorrectly configured access control security levels. This issue affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
- CVE-2026-96368Medium
The Drupal Webform module has an improper neutralization of input during web page generation vulnerability, leading to stored Cross-site Scripting (XSS). This issue affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
- CVE-2026-96367Medium
The Webform module for Drupal contains a Privilege Defined With Unsafe Actions vulnerability that allows Stored XSS. This issue affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
- CVE-2026-96366Medium
The Drupal Webform module has an incorrect authorization vulnerability, allowing forceful browsing. This issue affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
Original NVD description (English source)
Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS