---
id: "CVE-2026-114534"
kind: "vulnerability"
aliases: ["CVE-2026-114534"]
title: "Drupal Block Attributes: stored XSS in versions up to 2.1.0"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["block-attributes", "cms", "drupal", "package"]
not_affected_if: ["module-not-installed"]
published_at: "2026-10-30T04:18:12+00:00"
first_seen_at: "2026-10-30T04:28:37+00:00"
updated_at: "2026-10-30T04:31:04+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114534", "first_seen_at": "2026-10-30T04:28:37+00:00"}]
---

# Drupal Block Attributes: stored XSS in versions up to 2.1.0

The Drupal Block Attributes module contains a stored cross-site scripting flaw, so script injected into block attributes is saved and runs in visitors' browsers. An attacker who can enter that attribute data can run JavaScript in the context of other users' pages.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the Drupal Block Attributes module is installed and at what version, for example with `drush pm:list --filter=block_attributes` or by reviewing the module's `composer.lock` entry.
- Confirm whether the installed version is within the affected range, from `0.0.0` to `2.1.0`.

## Timeline

- 2026-10-30T04:28:37+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114534

## From the sources

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Block Attributes allows Stored XSS. This issue affects Block Attributes versions: from 0.0.0 to 2.1.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_