Live › vulnerability › CVE-2026-114531
The Swiper formatter module for Drupal has a stored cross-site scripting flaw, so attacker-supplied content saved on a page can run script in other visitors' browsers. The sources list affected versions 0.0.0 through 2.1.2 and 3.0.1 through 3.1.0.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Drupal sites that use the Swiper formatter to display fields with a Swiper carousel are in the affected version ranges. Sites that do not use this formatter, or run versions outside the listed ranges, are not affected according to the sources. The sources do not say whether anonymous or editor-level users can store the malicious content.
No product ranges from the sources yet.
drush pm:list or the Extend page) and compare it to the affected ranges.2.1.2 on the 2.x line or newer than 3.1.0 on the 3.x line; the sources do not name the exact fixed versions.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Swiper formatter allows Stored XSS. This issue affects Swiper formatter versions: from 0.0.0 to 2.1.2, from 3.0.1 to 3.1.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-114531")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.