A Cross-Site Scripting (XSS) vulnerability exists in Drupal AI versions from 0.0.0 to 1.4.11 and from 1.5.0 to 1.5.2 due to improper neutralization of input during web page generation. This flaw could allow an attacker to inject malicious scripts into web pages viewed by other users.
A stored cross-site scripting (XSS) vulnerability exists in the Drupal Data field component, affecting versions from 0.0.0 up to 2.0.14. This vulnerability is due to improper neutralization of input during web page generation, allowing malicious scripts to be stored and executed in users' browsers.
A stored cross-site scripting (XSS) vulnerability exists in Drupal USWDS Paragraph Components, affecting versions from 0.0.0 up to 3.1.3. This vulnerability arises from improper neutralization of input during web page generation, which could allow attackers to inject malicious scripts that are stored and later executed in users' browsers.
A Stored Cross-site Scripting (XSS) vulnerability exists in the Drupal Block Attributes module, affecting versions from 0.0.0 up to 2.1.0. This vulnerability is due to improper neutralization of input during web page generation, which can allow malicious scripts to be stored and executed in users' browsers.
A Cross-Site Scripting (XSS) vulnerability exists in Drupal Bootstrap versions from 0.0.0 up to 3.45.0 due to improper neutralization of input during web page generation. This vulnerability could allow an attacker to inject malicious scripts into web pages viewed by other users.
A Cross-Site Scripting (XSS) vulnerability exists in Drupal UI Icons due to improper neutralization of input during web page generation. This affects UI Icons versions from 0.0.0 to 1.1.3 and from 2.0.0 to 2.0.2. The vulnerability allows injection of malicious scripts in web pages generated by the affected component.
A stored cross-site scripting (XSS) vulnerability exists in the Drupal Swiper formatter module. This vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The affected versions include Swiper formatter from 0.0.0 to 2.1.2 and from 3.0.1 to 3.1.0.
A Cross-Site Scripting (XSS) vulnerability exists in the Drupal Gin Admin Theme due to improper neutralization of input during web page generation. This vulnerability affects Gin Admin Theme versions from 0.0.0 to 4.1.4 and from 5.0.0 to 5.0.16. The flaw allows injection of malicious scripts into web pages generated by the theme.
CVE-2026-114525 is a stored cross-site scripting (XSS) vulnerability in Drupal ABC. It affects versions from 0.0.0 to 1.25.0 and from 2.0.0 to 2.0.1. The flaw arises from improper neutralization of input during web page generation, allowing malicious scripts to be stored and executed in users' browsers.
CVE-2026-114528 is a stored cross-site scripting (XSS) vulnerability in Drupal Zero Point. It affects versions from 0.0.0 to 1.30.0 and from 2.0.0 to 2.0.1. The vulnerability arises from improper neutralization of input during web page generation, allowing malicious scripts to be stored and executed in users' browsers.
A Cross-Site Scripting (XSS) vulnerability exists in Drupal core due to improper neutralization of input during web page generation. This affects multiple Drupal core version ranges including 10.3.0 to 10.6.19, 11.0.0 to 11.3.19, 11.4.0 to 11.4.10, and 12.0.0-alpha1 to 12.0.0-beta2. The vulnerability allows injection of malicious scripts into web pages generated by Drupal.
A stored cross-site scripting (XSS) vulnerability exists in the Drupal Black Hole module affecting versions from 0.0.0 to 1.26.0 and 2.0.0 to 2.0.1. This vulnerability is due to improper neutralization of input during web page generation, allowing malicious scripts to be stored and executed in users' browsers.
A stored cross-site scripting (XSS) vulnerability exists in the Drupal CSV Field module due to improper neutralization of input during web page generation. This vulnerability affects CSV Field versions from 0.0.0 to 2.0.10 and from 3.0.0 to 3.0.7. Exploitation could allow an attacker to inject malicious scripts that are stored and executed in users' browsers when viewing affected pages.
A Cross-Site Scripting (XSS) vulnerability exists in the Drupal UI Icons component due to improper neutralization of input during web page generation. This affects UI Icons versions from 0.0.0 to 1.1.3 and from 2.0.0 to 2.0.2. The vulnerability allows injection of malicious scripts in web pages generated by the affected versions.
A Cross-Site Scripting (XSS) vulnerability exists in Drupal core due to improper neutralization of input during web page generation. This affects multiple Drupal core versions ranging from 8.9.0 through 12.0.0-beta2 in specified version intervals. The vulnerability allows injection of malicious scripts into web pages generated by Drupal.
A Cross-Site Scripting (XSS) vulnerability exists in the Drupal Country module due to improper neutralization of input during web page generation. This vulnerability affects versions from 0.0.0 to 2.1.3 and from 2.2.0 to 2.2.1. The issue allows an attacker with high privileges and user interaction to potentially execute malicious scripts in a user's browser. The vulnerability is rated as low severity with a CVSS score of 3.1.
A stored cross-site scripting (XSS) vulnerability exists in the Drupal Leaflet module, affecting versions from 0.0.0 up to 10.4.13. This vulnerability arises from improper neutralization of input during web page generation, allowing malicious scripts to be stored and executed in users' browsers.
CVE-2026-107306 is a stored cross-site scripting (XSS) vulnerability in the Drupal Menu Link Attributes module. It affects versions from 0.0.0 up to and including 1.8.0. The flaw involves improper neutralization of input during web page generation, which could allow an attacker with high privileges to inject malicious scripts. The vulnerability has a low CVSS score of 3.8, indicating limited impact. No public exploits or known active exploitation have been reported. No patch or fix information is provided in the available data.
A stored cross-site scripting (XSS) vulnerability exists in Drupal Sector Distribution, affecting versions from 0.0.0 to 10.3.3 and 10.4.0 to 10.4.2. This vulnerability arises from improper neutralization of input during web page generation, which could allow an attacker to inject malicious scripts that are stored and later executed in users' browsers.
A Cross-Site Scripting (XSS) vulnerability exists in the Drupal MathJax: LaTeX module, affecting versions up to 4.1.2. This vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The vulnerability has a medium severity rating with a CVSS score of 5.4.