CVE-2026-84924: Email Verification / SMS Verification / OTP Verification - Critical - Cross Site Scripting - SA-CONTRIB-2026-125
Published Oct 22, 2026
·Updated
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Reflected XSS. This issue affects Email Verification / SMS Verification / OTP Verification versions: from 0.0.0 to 2.4.0.
Affected Software
3 affected components
Drupal Email Verification>=0.0.0<=2.4.0
Drupal SMS Verification>=0.0.0<=2.4.0
Drupal OTP Verification>=0.0.0<=2.4.0
Event History
Oct 22, 2026
CVE Published
via MITRE·01:22 AM
Data Sourced
via MITRE·01:22 AM
DescriptionWeakness