{"id":"CVE-2026-114531","kind":"vulnerability","aliases":["CVE-2026-114531"],"related":[],"title":"Drupal Swiper formatter: stored XSS via unescaped input in pages","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Swiper formatter allows Stored XSS. This issue affects Swiper formatter versions: from 0.0.0 to 2.1.2, from 3.0.1 to 3.1.0.","summary":"The Swiper formatter module for Drupal has a stored cross-site scripting flaw, so attacker-supplied content saved on a page can run script in other visitors' browsers. The sources list affected versions 0.0.0 through 2.1.2 and 3.0.1 through 3.1.0.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cms","drupal","other","swiper-formatter"],"not_affected_if":["fixed-version","no-swiper-formatter"],"how_to_check":"- Check the installed Swiper formatter version in the Drupal project (for example with `drush pm:list` or the Extend page) and compare it to the affected ranges.","fix":"- Move to a Swiper formatter release newer than `2.1.2` on the 2.x line or newer than `3.1.0` on the 3.x line; the sources do not name the exact fixed versions.","status":"open","published_at":"2026-10-30T04:18:11+00:00","first_seen_at":"2026-10-30T04:28:37+00:00","triaged_at":"2026-10-30T04:31:05+00:00","updated_at":"2026-10-30T04:31:05+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-30T04:31:05Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a Swiper formatter release newer than `2.1.2` on the 2.x line or newer than `3.1.0` on the 3.x line; the sources do not name the exact fixed versions.","reach":"internet","title":"Drupal Swiper formatter: stored XSS via unescaped input in pages","impact":"medium","summary":"The Swiper formatter module for Drupal has a stored cross-site scripting flaw, so attacker-supplied content saved on a page can run script in other visitors' browsers. The sources list affected versions 0.0.0 through 2.1.2 and 3.0.1 through 3.1.0.","audience":"businesses","category":"other","nicknames":[],"who_cares":["drupal","swiper-formatter","cms"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"script runs in visitors' browsers and steals sessions","analyst_note":"Confirm the fixed Swiper formatter versions and whether editor or anonymous input is needed, from the Drupal security advisory.","how_to_check":"- Check the installed Swiper formatter version in the Drupal project (for example with `drush pm:list` or the Extend page) and compare it to the affected ranges.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-swiper-formatter","fixed-version"],"who_is_affected":"Drupal sites that use the Swiper formatter to display fields with a Swiper carousel are in the affected version ranges. Sites that do not use this formatter, or run versions outside the listed ranges, are not affected according to the sources. The sources do not say whether anonymous or editor-level users can store the malicious content.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000723,"input_tokens":4130,"output_tokens":621,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-114531':13A,16A '-2026':12A,15A '0.0.0':58B,92C '2.1.2':60B,94C '3.0.1':62B,96C '3.1.0':64B,98C 'affect':56B,87C 'allow':82C 'attack':39B 'attacker-suppli':38B 'browser':52B 'cms':17B 'content':41B 'cross':33B,74C 'cross-sit':32B,73C 'cve':11A,14A 'drupal':1A,18B,28B,79C 'flaw':36B 'formatt':3A,22B,25B,81C,89C 'generat':72C 'improp':65C 'input':8A,68C 'issu':86C 'list':55B 'modul':26B 'neutral':66C 'page':10A,45B,71C 'run':47B 'save':42B 'script':35B,48B,76C 'site':34B,75C 'sourc':54B 'store':4A,31B,83C 'suppli':40B 'swiper':2A,21B,24B,80C,88C 'swiper-formatt':20B 'unescap':7A 'version':57B,90C 'via':6A 'visitor':51B 'vulner':77C 'web':70C 'xss':5A,84C","nicknames":[],"mitigations":[],"who_affected":"Drupal sites that use the Swiper formatter to display fields with a Swiper carousel are in the affected version ranges. Sites that do not use this formatter, or run versions outside the listed ranges, are not affected according to the sources. The sources do not say whether anonymous or editor-level users can store the malicious content.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:18:11+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114531","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114531","severity":null,"published_at":"2026-10-30T04:18:11+00:00","modified_at":"2026-10-30T04:18:11+00:00","first_seen_at":"2026-10-30T04:28:37+00:00","fetched_at":"2026-10-30T04:28:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}