CVE-2026-96368
MediumCVSS 4.6Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The Drupal Webform module has an improper neutralization of input during web page generation vulnerability, leading to stored Cross-site Scripting (XSS). This issue affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
Risk Assessment
An attacker could inject malicious JavaScript that executes in the browsers of other users visiting the site. This could lead to session theft, account takeover, or other attacks.
Recommendation
Update the Webform module to a version later than 6.2.12 or 6.3.1 that contains the fix. Additionally, consider implementing a Content Security Policy (CSP).
Other vulnerabilities in Drupal Webform
See all- CVE-2026-96355Critical
The Webform module for Drupal (versions 0.0.0 to 6.2.12 and 6.3.0 to 6.3.1) is vulnerable to code injection due to improper neutralization of special elements used in a template engine.
- CVE-2026-96398Medium
The Drupal Webform module contains an Incorrect Authorization vulnerability that allows Forceful Browsing. The issue affects versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
- CVE-2026-96373Low
The Drupal Webform module contains an incorrect authorization vulnerability allowing forceful browsing. This issue affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
- CVE-2026-96372Medium
The Drupal Webform module has an insufficient granularity of access control vulnerability, allowing forceful browsing. This issue affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
- CVE-2026-96371Medium
The Drupal Webform module contains a Privilege Defined With Unsafe Actions vulnerability that allows stored XSS. The issue affects versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
- CVE-2026-96370Medium
The Drupal Webform module has an incorrect authorization vulnerability, allowing Server Side Request Forgery (SSRF). This issue affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
- CVE-2026-96369Low
The Drupal Webform module uses browser cache containing sensitive information due to incorrectly configured access control security levels. This issue affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
- CVE-2026-96367Medium
The Webform module for Drupal contains a Privilege Defined With Unsafe Actions vulnerability that allows Stored XSS. This issue affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
- CVE-2026-96366Medium
The Drupal Webform module has an incorrect authorization vulnerability, allowing forceful browsing. This issue affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
- CVE-2026-96365High
The Drupal Webform module contains an Allocation of Resources Without Limits or Throttling vulnerability allowing Excessive Allocation. This issue affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS