Swiper formatter: The module provides integration with third party JS library SwiperJs. (CVE-2026-114531)

The swiper_formatter module for Drupal, which integrates the third-party JavaScript library SwiperJs, contains a cross-site scripting (XSS) vulnerability. This occurs because user-entered text is incorporated into slide captions without proper filtering, allowing injection of malicious scripts. However, exploitation is mitigated by the requirement that an attacker must have permissions to edit captions, restricting the vulnerability to privileged users. The affected versions are those prior to 2.1.2 and versions from 3.0.1 up to but not including 3.1.0. A patch is available to address this issue.

Successful exploitation could allow an attacker with caption editing permissions to execute arbitrary scripts in the context of the affected site, potentially leading to session hijacking or other client-side attacks. Since the vulnerability requires elevated permissions, the risk is limited to users with editing capabilities rather than anonymous or low-privileged users.

A patch is available for this vulnerability and should be applied to affected versions. Until patched, restrict caption editing permissions to trusted users only to mitigate exploitation risk.