DRUPAL-CONTRIB-2026-222: Zero Point - Critical - Cross-site scripting - SA-CONTRIB-2026-222

Q: Which Zero Point versions are affected?

Affected versions are 0.0.0 through 1.30.0 and 2.0.0 through 2.0.1.

Q: Does exploitation require an authenticated account?

No. The listed vector specifies PR:N, meaning no privileges are required, although user interaction is required (UI:R).

Q: What is the potential impact of successful exploitation?

The issue is stored cross-site scripting and can affect confidentiality, integrity, and availability at low impact levels. The scope is changed (S:C), indicating the vulnerable component can affect resources beyond its own security authority.

Published Oct 30, 2026

Updated

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Zero Point allows Stored XSS. This issue affects Zero Point versions: from 0.0.0 to 1.30.0, from 2.0.0 to 2.0.1.

Affected Software

1 affected component

Drupal Zero Point>=0.0.0<=1.30.0, >=2.0.0<=2.0.1

Event History

Oct 30, 2026

CVE Published

via OSV·03:09 AM

Data Sourced

via OSV·03:09 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which Zero Point versions are affected?

Affected versions are 0.0.0 through 1.30.0 and 2.0.0 through 2.0.1.

Does exploitation require an authenticated account?

No. The listed vector specifies PR:N, meaning no privileges are required, although user interaction is required (UI:R).

What is the potential impact of successful exploitation?

The issue is stored cross-site scripting and can affect confidentiality, integrity, and availability at low impact levels. The scope is changed (S:C), indicating the vulnerable component can affect resources beyond its own security authority.

DRUPAL-CONTRIB-2026-222: Zero Point - Critical - Cross-site scripting - SA-CONTRIB-2026-222

Affected Software

Event History

Frequently Asked Questions

Which Zero Point versions are affected?

Does exploitation require an authenticated account?

What is the potential impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which Zero Point versions are affected?

Does exploitation require an authenticated account?

What is the potential impact of successful exploitation?