Live › vulnerability › CVE-2026-114534
The Drupal Block Attributes module contains a stored cross-site scripting flaw, so script injected into block attributes is saved and runs in visitors' browsers. An attacker who can enter that attribute data can run JavaScript in the context of other users' pages.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Sites running Drupal with the Block Attributes module installed at a version in the affected range. The sources do not say whether the flaw needs a particular permission to exploit, so the exposed role is unknown. Sites without this module are not affected.
No product ranges from the sources yet.
drush pm:list --filter=block_attributes or by reviewing the module's composer.lock entry.0.0.0 to 2.1.0.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Block Attributes allows Stored XSS. This issue affects Block Attributes versions: from 0.0.0 to 2.1.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-114534")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.