CVE-2026-96367
CVE-2026-96367 · Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-162
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVSS 4.6 · Medium · EPSS 0.2% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
webform
- Versions
- ≥ 0.0.0, < 6.2.12: Affected (semver)
- ≥ 6.3.0, < 6.3.1: Affected (semver)
Update to 6.2.12; Update to 6.3.1
drupal/webform Packagist:https://packages.drupal.org/8
- Affected ranges
- ECOSYSTEM: < 6.2.12
- ECOSYSTEM: ≥ 6.3.0, < 6.3.1
Update to 6.2.12; Update to 6.3.1