CVE-2026-96359: Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-159
Published Oct 22, 2026
·Updated
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
Affected Software
1 affected component
Drupal Webform>=0.0.0<=6.2.12, >=6.3.0<=6.3.1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SA-CONTRIB-2026-159
Event History
Oct 22, 2026
CVE Published
via MITRE·01:21 AM
Data Sourced
via MITRE·01:21 AM
DescriptionWeakness