CVE-2026-96361: Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-155

Q: Which Webform installations are affected?

Affected versions are 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1. The provided information does not identify any other affected products or configurations.

Q: What type of impact can exploitation have?

The issue allows cross-site scripting because input is not properly neutralized during web page generation. The provided information does not specify the required attacker privileges, user interaction, or affected Webform features.

Published Oct 22, 2026

Updated

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

Affected Software

1 affected component

Drupal Webform>=0.0.0<=6.2.12, >=6.3.0<=6.3.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SA-CONTRIB-2026-155

Event History

Oct 22, 2026

CVE Published

via MITRE·01:21 AM

Data Sourced

via MITRE·01:21 AM

DescriptionWeakness

Frequently Asked Questions

Which Webform installations are affected?

Affected versions are 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1. The provided information does not identify any other affected products or configurations.

What type of impact can exploitation have?

The issue allows cross-site scripting because input is not properly neutralized during web page generation. The provided information does not specify the required attacker privileges, user interaction, or affected Webform features.