Live › vulnerability › CVE-2026-84919
Go to dashboardThe Drupal PhotoSwipe responsive image gallery module fails to neutralize input when generating web pages, enabling stored cross-site scripting. An attacker who can store content that the gallery renders can run JavaScript in other visitors' browsers.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Drupal sites running the PhotoSwipe module at version 5.0.9 or earlier, where gallery output shows content entered by users with lower trust. Sites without the module installed, or that only show gallery content entered by trusted editors, face less risk. Hosted sites that do not run Drupal can skip it.
No product ranges from the sources yet.
drush pm:list --filter=photoswipe or in the Drupal admin under Extend5.0.9Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Stored XSS. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 5.0.9.
This page as .md · .json · in your agent: get_signal("CVE-2026-84919")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.