CVE-2026-87939: Feed Block - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-137

Q: Which Feed Block versions need remediation?

The affected version ranges are 0.0.0 through 2.0.2 and 3.0.0 through 3.0.2. Versions outside those ranges are not identified as affected in the provided advisory data.

Q: What is the impact of successful exploitation?

Successful exploitation results in stored cross-site scripting. Malicious input can be retained and later rendered in a web page without proper neutralization.

Published Oct 22, 2026

Updated

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Feed Block allows Stored XSS. This issue affects Feed Block versions: from 0.0.0 to 2.0.2, from 3.0.0 to 3.0.2.

Affected Software

1 affected component

Drupal Feed Block>=0.0.0<=2.0.2, >=3.0.0<=3.0.2

Event History

Oct 22, 2026

CVE Published

via MITRE·01:22 AM

Data Sourced

via MITRE·01:22 AM

DescriptionWeakness

Frequently Asked Questions

Which Feed Block versions need remediation?

The affected version ranges are 0.0.0 through 2.0.2 and 3.0.0 through 3.0.2. Versions outside those ranges are not identified as affected in the provided advisory data.

What is the impact of successful exploitation?

Successful exploitation results in stored cross-site scripting. Malicious input can be retained and later rendered in a web page without proper neutralization.

CVE-2026-87939: Feed Block - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-137

Affected Software

Event History

Frequently Asked Questions

Which Feed Block versions need remediation?

What is the impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which Feed Block versions need remediation?

What is the impact of successful exploitation?