CVE-2026-114534

CVE-2026-114534 · DRUPAL-CONTRIB-2026-232

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This module allows you to define custom attributes for a block. You can specify an attribute name to be added to the block in a predefined format. The module does not sufficiently sanitize attributes against cross site scripting. This issue is mitigated by the fact that the attacker must have the `administer blocks` permission.

Fix available

Published

2026-10-21T17:46:09Z

Updated

2026-10-21T18:15:02.900561860Z

Stack: php

Check your server →