Live › vulnerability › CVE-2026-118560
Drupal Commerce Stripe, a payment module for Drupal stores, has a cross-site scripting flaw in versions 2.0.0 through 2.2.3. An attacker can inject script into pages the module generates, which runs in a visitor's browser.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Drupal sites that run the Commerce Stripe module in the affected range are exposed, since the flaw is in pages the module builds. Sites that do not use Commerce Stripe can skip it. The sources do not say whether a logged-in user or special configuration is required.
No product ranges from the sources yet.
composer show drupal/commerce_stripe) and see whether it falls in 2.0.0 to 2.2.3.2.2.3; the sources do not name the exact fixed release.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Commerce Stripe allows Cross-Site Scripting (XSS). This issue affects Commerce Stripe versions: from 2.0.0 to 2.2.3.
This page as .md · .json · in your agent: get_signal("CVE-2026-118560")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.