CVE-2026-96357: Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-172

Q: Which Webform installations are affected?

Affected versions are 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1. The supplied information does not identify unaffected fixed versions.

Q: What type of impact can exploitation have?

The issue allows stored cross-site scripting. Malicious input can be retained and later executed in a user's browser when the affected web page is generated.

Published Oct 22, 2026

Updated

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

Affected Software

1 affected component

Drupal Webform>=0.0.0<=6.2.12, >=6.3.0<=6.3.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Drupal Webform to a version that resolves this vulnerability.
Patch SA-CONTRIB-2026-172

Event History

Oct 22, 2026

CVE Published

via MITRE·01:21 AM

Data Sourced

via MITRE·01:21 AM

DescriptionWeakness

Frequently Asked Questions

Which Webform installations are affected?

Affected versions are 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1. The supplied information does not identify unaffected fixed versions.

What type of impact can exploitation have?

The issue allows stored cross-site scripting. Malicious input can be retained and later executed in a user's browser when the affected web page is generated.