DRUPAL-CONTRIB-2026-234: USWDS Paragraph Components - Moderately critical - Cross site scripting - SA-CONTRIB-2026-234

Q: Which installations are affected?

Drupal sites using USWDS Paragraph Components versions from 0.0.0 through 3.1.3 are affected.

Q: What level of access does an attacker need?

The vector indicates network-reachable exploitation with low privileges required and user interaction required. The issue is stored XSS, so injected content may affect users who later view the rendered page.

Published Oct 30, 2026

Updated

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal USWDS Paragraph Components allows Stored XSS. This issue affects USWDS Paragraph Components versions: from 0.0.0 to 3.1.3.

Affected Software

1 affected component

Drupal USWDS Paragraph Components>=0.0.0<=3.1.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Drupal USWDS Paragraph Components to a version that resolves this vulnerability.
Fixed in 3.1.3Patch SA-CONTRIB-2026-234

Event History

Oct 30, 2026

CVE Published

via OSV·03:09 AM

Data Sourced

via OSV·03:09 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations are affected?

Drupal sites using USWDS Paragraph Components versions from 0.0.0 through 3.1.3 are affected.

What level of access does an attacker need?

The vector indicates network-reachable exploitation with low privileges required and user interaction required. The issue is stored XSS, so injected content may affect users who later view the rendered page.

DRUPAL-CONTRIB-2026-234: USWDS Paragraph Components - Moderately critical - Cross site scripting - SA-CONTRIB-2026-234

Affected Software

Remediation

Event History

Frequently Asked Questions

Which installations are affected?

What level of access does an attacker need?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

What level of access does an attacker need?