CVE-2026-114536: USWDS Paragraph Components - Moderately critical - Cross site scripting - SA-CONTRIB-2026-234
Published Oct 30, 2026
·Updated
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal USWDS Paragraph Components allows Stored XSS. This issue affects USWDS Paragraph Components versions: from 0.0.0 to 3.1.3.
Affected Software
1 affected component
Drupal USWDS Paragraph Components>=0.0.0<=3.1.3
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Drupal USWDS Paragraph Componentsto a version that resolves this vulnerability.Patch SA-CONTRIB-2026-234
Event History
Oct 30, 2026
CVE Published
via MITRE·03:09 AM
Data Sourced
via MITRE·03:09 AM
DescriptionWeakness
Data Sourced
via OSV·03:09 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:18 AM
DescriptionWeakness
Nov 6, 2026
Data Sourced
via NVD·04:17 PM
Severity
Frequently Asked Questions
1
Which versions should be considered affected?
USWDS Paragraph Components versions from 0.0.0 through 3.1.3 are affected by the stored cross-site scripting vulnerability.
2
What type of attack does this issue enable?
The issue allows stored cross-site scripting due to improper neutralization of input during web page generation. Malicious input may be stored and later executed in users' browsers when affected content is rendered.