Live › vulnerability › CVE-2026-110738
The Gin Admin Theme for Drupal has a cross-site scripting flaw in how it builds web pages from input. An attacker who gets a crafted input into the page can run script in the browser of a logged-in user, such as an administrator.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Drupal sites that run the Gin Admin Theme at versions up to 4.1.4 or from 5.0.0 through 5.0.16. The sources do not say which input path is involved or whether anonymous users can reach it, so the exposure of a given site is unknown.
No product ranges from the sources yet.
composer show drupal/gin or the Extend page.4.1.4 on the 4.x line, or past 5.0.16 on the 5.x line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Gin Admin Theme allows Cross-Site Scripting (XSS). This issue affects Gin Admin Theme versions: from 0.0.0 to 4.1.4, from 5.0.0 to 5.0.16.
This page as .md · .json · in your agent: get_signal("CVE-2026-110738")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.