CVE-2026-84915: Component blocks - Moderately critical - Cross site scripting - SA-CONTRIB-2026-123

Q: Which installations are affected?

Drupal sites using the Component blocks module are affected if the installed version is from 0.0.0 through 1.2.7.

Q: What type of impact can exploitation have?

The vulnerability allows stored cross-site scripting, meaning attacker-controlled input can be saved and later executed in a user's browser when the affected content is rendered.

Published Oct 22, 2026

Updated

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Component blocks allows Stored XSS. This issue affects Component blocks versions: from 0.0.0 to 1.2.7.

Affected Software

1 affected component

Drupal Component blocks>=0.0.0<=1.2.7

Event History

Oct 22, 2026

CVE Published

via MITRE·01:22 AM

Data Sourced

via MITRE·01:22 AM

DescriptionWeakness

Frequently Asked Questions

Which installations are affected?

Drupal sites using the Component blocks module are affected if the installed version is from 0.0.0 through 1.2.7.

What type of impact can exploitation have?

The vulnerability allows stored cross-site scripting, meaning attacker-controlled input can be saved and later executed in a user's browser when the affected content is rendered.

CVE-2026-84915: Component blocks - Moderately critical - Cross site scripting - SA-CONTRIB-2026-123

Affected Software

Event History

Frequently Asked Questions

Which installations are affected?

What type of impact can exploitation have?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

What type of impact can exploitation have?