DRUPAL-CONTRIB-2026-232: Block Attributes - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-232
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Block Attributes allows Stored XSS. This issue affects Block Attributes versions: from 0.0.0 to 2.1.0.
Affected Software
Event History
Frequently Asked Questions
Which installations are affected?
Drupal sites using the Block Attributes module in versions from 0.0.0 through 2.1.0 are affected.
What access does an attacker need to exploit this issue?
The vector indicates network reachability, low attack complexity, high privileges, and user interaction. Exploitation requires an attacker with high privileges and a user to interact with the stored malicious content.
What is the potential impact of successful exploitation?
Successful exploitation can result in stored cross-site scripting and may affect confidentiality, integrity, and availability at a low level. The scope is changed, meaning the impact can extend beyond the vulnerable component.