Live › vulnerability › CVE-2026-96379
Go to dashboardCookieCuttr, a Drupal module for cookie consent banners, has a stored cross-site scripting flaw in versions 2.0.0 through 2.0.3. An attacker who can store input that the module later renders can run scripts in other visitors' browsers.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Drupal sites running the CookieCuttr module in versions 2.0.0 to 2.0.3 are potentially exposed. The sources do not say which roles can store the input, so sites that restrict who can edit content or banner text are likely lower risk. Sites without the module can skip it.
No product ranges from the sources yet.
drush pm:list --filter=cookiecuttr or the Drupal admin Extend pagemodules/contrib/cookiecuttr and read its *.info.yml version field2.0.3 (exact fixed version: unknown from the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal CookieCuttr allows Stored XSS. This issue affects CookieCuttr versions: from 2.0.0 to 2.0.3.
This page as .md · .json · in your agent: get_signal("CVE-2026-96379")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.