CVE-2026-96360: CWE-79 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") in Drupal Webform

This vulnerability is classified as CWE-79, indicating improper neutralization of input during web page generation leading to Cross-Site Scripting (XSS). The affected product is the Drupal Webform module. The vulnerability affects versions >=0.0.0 <6.2.12 and >=6.3.0 <6.3.1. No CVSS score or detailed vendor advisory is provided, and no known exploits in the wild have been reported. Patch or remediation information is not specified in the input data.

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages generated by the Drupal Webform module. This could lead to client-side script execution in the context of the affected site, potentially resulting in session hijacking, defacement, or other client-side attacks. However, no specific impact details or exploitation reports are provided.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor official Drupal Webform module advisories for patches addressing this vulnerability. Until a patch is available, consider applying input validation or output encoding controls where feasible to mitigate XSS risks.