Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Stored XSS. (CVE-2026-96357)

The Drupal Webform module contains a stored cross-site scripting (XSS) vulnerability identified as CVE-2026-96357. This vulnerability arises from improper neutralization of input during web page generation, enabling attackers with low privileges to inject malicious scripts that persist in the application. Affected versions include all releases from 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1. The vulnerability has a CVSS v3.1 base score of 4.6, indicating medium severity. There is no indication of known exploits in the wild or cloud service impact. No patch or remediation information is provided in the available data.

Successful exploitation could allow an attacker with limited privileges to inject and store malicious scripts in the web application, potentially leading to limited confidentiality and integrity impacts through script execution in users' browsers. There is no indication of availability impact. The vulnerability could be leveraged to perform actions such as session hijacking or defacement, but the impact is rated as medium.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user input where possible and apply web application firewall rules to detect and block XSS payloads. Monitor official Drupal Webform advisories for updates and patches.