CVE-2026-96362: Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-160
Published Oct 22, 2026
·Updated
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
Event History
Oct 22, 2026
CVE Published
via MITRE·01:21 AM
Data Sourced
via MITRE·01:21 AM
DescriptionWeakness
Frequently Asked Questions
1
Which Webform installations are affected?
Affected versions are 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1. The provided information does not identify affected Drupal core versions or configuration-specific conditions.
2
What level of attacker access is required to exploit this issue?
The provided information identifies the issue as cross-site scripting caused by improper neutralization of input during web page generation, but does not state what access, permissions, or interaction an attacker needs.