Live › vulnerability › CVE-2026-96363
Go to dashboardDrupal Webform versions up to 6.2.12 and 6.3.0 through 6.3.1 have a permission flaw that allows stored cross-site scripting. An attacker with a low-privilege role can store script in form content that runs in other users' browsers.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Drupal Webform module in the affected version ranges, where users without full administrative rights can create or edit forms or submission content. Sites not using Webform, or running a patched release, can skip it.
No product ranges from the sources yet.
drush pm:list --filter=webform or the Extend page in the Drupal admin.6.3.1 (the sources list 6.2.12 and 6.3.1 as affected; the fixed version is unknown).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-96363")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.