CVE-2026-55805: CWE-79 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") in Drupal Drupal core

This vulnerability in Drupal core (CWE-79) involves improper neutralization of input during web page generation, resulting in stored cross-site scripting (XSS). It affects Drupal core versions from 0.0.0 up to 10.6.13, 11.3.0 to 11.3.14, and 11.4.0 to 11.4.4, as well as all versions up to 11.0.*, 11.1.*, and 11.2.*. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring low privileges and user interaction, with a scope change and limited confidentiality and integrity impact but no availability impact. No patch or official remediation level is currently documented.

Successful exploitation could allow an attacker to execute stored malicious scripts in the context of the vulnerable Drupal web application, potentially leading to limited confidentiality and integrity impacts. The vulnerability does not affect availability. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should monitor official Drupal security channels for updates. No vendor advisory or patch links are currently provided.