{"id":"CVE-2026-87939","kind":"vulnerability","aliases":["CVE-2026-87939"],"related":[],"title":"Drupal Feed Block: stored XSS in feed rendering","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Feed Block allows Stored XSS. This issue affects Feed Block versions: from 0.0.0 to 2.0.2, from 3.0.0 to 3.0.2.","summary":"The Drupal Feed Block module lets input be stored and later rendered on a page without proper escaping. An attacker who can submit that input can run script in the browser of anyone who views the page.","severity":"medium","cvss":4.2,"epss":0.00156,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cms","drupal","other","php"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check the installed Feed Block version with `drush pm:list --filter=feed_block` or in the Drupal admin under Extend.\n- Confirm whether the site uses the Feed Block module at all.","fix":"- Upgrade Feed Block to a release newer than `2.0.2` on the 2.x line or newer than `3.0.2` on the 3.x line; the sources do not name the exact fixed version.","status":"open","published_at":"2026-10-22T02:17:03+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:41:25+00:00","updated_at":"2026-10-25T04:41:25+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T04:41:25Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Feed Block to a release newer than `2.0.2` on the 2.x line or newer than `3.0.2` on the 3.x line; the sources do not name the exact fixed version.","reach":"internet","title":"Drupal Feed Block: stored XSS in feed rendering","impact":"medium","summary":"The Drupal Feed Block module lets input be stored and later rendered on a page without proper escaping. An attacker who can submit that input can run script in the browser of anyone who views the page.","category":"other","nicknames":[],"who_cares":["drupal","cms","php"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker script runs in visitors' browsers on the site.","analyst_note":"","how_to_check":"- Check the installed Feed Block version with `drush pm:list --filter=feed_block` or in the Drupal admin under Extend.\n- Confirm whether the site uses the Feed Block module at all.","needs_analyst":false,"not_affected_if":["module-not-installed"],"who_is_affected":"Sites running Drupal with the Feed Block module in versions 0.0.0 to 2.0.2 or 3.0.0 to 3.0.2. Exposure depends on who can enter the content that the block stores and renders, which the sources do not describe. Sites without the module can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000586,"input_tokens":3365,"output_tokens":498,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':10A,13A '-87939':11A,14A '0.0.0':83C '2.0.2':85C '3.0.0':87C '3.0.2':89C 'affect':78C 'allow':73C 'anyon':51B 'attack':38B 'block':3A,22B,72C,80C 'browser':49B 'cms':15B 'cross':65C 'cross-sit':64C 'cve':9A,12A 'drupal':1A,16B,20B,70C 'escap':36B 'feed':2A,7A,21B,71C,79C 'generat':63C 'improp':56C 'input':25B,43B,59C 'issu':77C 'later':29B 'let':24B 'modul':23B 'neutral':57C 'page':33B,55B,62C 'php':18B 'proper':35B 'render':8A,30B 'run':45B 'script':46B,67C 'site':66C 'store':4A,27B,74C 'submit':41B 'version':81C 'view':53B 'vulner':68C 'web':61C 'without':34B 'xss':5A,75C","nicknames":[],"mitigations":[],"who_affected":"Sites running Drupal with the Feed Block module in versions 0.0.0 to 2.0.2 or 3.0.0 to 3.0.2. Exposure depends on who can enter the content that the block stores and renders, which the sources do not describe. Sites without the module can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:17:03+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87939","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87939","severity":null,"published_at":"2026-10-22T02:17:03+00:00","modified_at":"2026-10-22T18:17:31+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-87939","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87939","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}