CVE-2026-96368: CWE-79 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") in Drupal Webform

CVE-2026-96368 is a stored cross-site scripting (XSS) vulnerability in the Drupal Webform module caused by improper input neutralization during web page generation. This allows attackers to inject malicious scripts that are stored and later executed in the context of users viewing the affected webforms. The vulnerability affects Webform versions >=0.0.0 <6.2.12 and >=6.3.0 <6.3.1. No CVSS score or detailed vendor advisory information is provided.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of users interacting with the vulnerable Webform module, potentially leading to session hijacking, defacement, or other malicious actions within the affected web application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor Drupal's official security advisories for updates and apply any official fixes once available. Until a patch is confirmed, consider restricting access to vulnerable Webform versions or applying input validation and output encoding as temporary mitigations.