---
id: "CVE-2026-96357"
kind: "vulnerability"
aliases: ["CVE-2026-96357"]
title: "Drupal Webform: stored cross-site scripting in web page output"
severity: "medium"
cvss: 4.6
epss: 0.00172
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["drupal", "package", "self-hosted", "webform"]
not_affected_if: ["patched-version", "webform-not-installed"]
published_at: "2026-10-22T02:17:05+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T04:35:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96357", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-96357", "first_seen_at": "2026-10-24T07:15:52+00:00"}]
---

# Drupal Webform: stored cross-site scripting in web page output

The Drupal Webform module fails to neutralize input when generating web pages, allowing stored XSS. An attacker who can submit or store crafted content can run scripts in other users' browsers.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Webform version with `drush pm:list --filter=webform` or the Drupal admin Extend page
- Confirm whether the installed version is between `0.0.0` and `6.2.12`, or `6.3.0` to `6.3.1`

## Fix

- Upgrade the Drupal Webform module to a release newer than `6.3.1` or `6.2.12` (exact fixed version unknown from sources)

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-96357
- 2026-10-24T07:15:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-96357

## From the sources

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_