CVE-2026-55805: CWE-79 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") in Drupal Drupal core

This vulnerability in Drupal core (CWE-79) allows stored cross-site scripting due to improper input neutralization during web page generation. The issue affects a broad range of Drupal core versions: from initial releases up to 10.6.13, and from 11.3.0 through 11.3.14, as well as 11.4.0 through 11.4.4. The vulnerability permits attackers to inject malicious scripts that are stored and later executed in users' browsers. No information about patch availability or vendor remediation is provided in the input data.

Successful exploitation of this vulnerability could allow attackers to execute arbitrary scripts in the context of users visiting the affected Drupal sites, potentially leading to session hijacking, defacement, or other malicious actions. The input data does not specify any known exploits in the wild or detailed impact scenarios.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, administrators should monitor Drupal security advisories for updates and consider applying any forthcoming patches promptly. No vendor advisory content is available to indicate if any temporary mitigations or workarounds exist.