---
id: "CVE-2026-96382"
kind: "vulnerability"
aliases: ["CVE-2026-96382"]
title: "Drupal Diba carousel slider: stored XSS through input handling up to 3.0.2"
severity: "medium"
cvss: 4.6
epss: 0.00133
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["drupal", "package", "php", "self-hosted"]
not_affected_if: ["module-not-installed"]
published_at: "2026-10-22T02:17:08+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T04:35:21+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96382", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-96382", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Drupal Diba carousel slider: stored XSS through input handling up to 3.0.2

The Diba carousel slider module for Drupal does not neutralize some user-supplied input before writing it into web pages, so the stored content can run script in visitors' browsers. An attacker who can get content stored through the module can run script in the browser of anyone who views the affected page.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Diba carousel slider version in the Drupal project (`composer show drupal/diba` or the Extend page) and see whether it is `3.0.2` or earlier.
- unknown

## Fix

- Upgrade the Diba carousel slider module to a version later than `3.0.2`; the fixed version number is unknown from the sources.

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-96382
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-96382

## From the sources

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Diba carousel slider allows Stored XSS. This issue affects Diba carousel slider versions: from 0.0.0 to 3.0.2.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_