Live › vulnerability › CVE-2026-96371
Go to dashboardDrupal Webform has a privilege definition flaw that allows stored cross-site scripting. An attacker with the right permission can save script that runs in other users' browsers.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running Drupal with the Webform module in the affected version ranges. Sites without Webform, or on a patched version, are not exposed. The sources do not say which roles can trigger the stored payload.
No product ranges from the sources yet.
drush pm:list --filter=webform or the Drupal extend page.6.2.12 or 6.3.1 on the 6.x line, per the Drupal security advisory (unknown exact fixed version).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-96371")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.