CWE-79: Cross-site Scripting vulnerabilities

CVE-2026-114528 is a high-severity stored cross-site scripting (XSS) vulnerability in the Drupal Zero Point product. It affects versions from 0.0.0 up to but not including 1.30.0, and from 2.0.0 up to but not including 2.0.1. The vulnerability involves improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. Fixed versions are 1.30.0 and 2.0.1.

CVE-2026-114526 is a high-severity stored cross-site scripting (XSS) vulnerability in the Drupal Black Hole module. It affects Black Hole versions from 0.0.0 up to but not including 1.26.0, and from 2.0.0 up to but not including 2.0.1. The vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that can execute in users' browsers. Fixed versions 1.26.0 and 2.0.1 are available.

CVE-2026-114525 is a stored cross-site scripting (XSS) vulnerability in the Drupal ABC product. It affects versions from 0.0.0 up to but not including 1.25.0, and from 2.0.0 up to but not including 2.0.1. The vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker to execute arbitrary scripts in the context of the affected application. The issue has been fixed in versions 1.25.0 and 2.0.1.

CVE-2026-114529 is a stored cross-site scripting (XSS) vulnerability in the Drupal CSV Field module. It affects versions from 0.0.0 up to but not including 2.0.10, and from 3.0.0 up to but not including 3.0.7. The flaw involves improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. The vulnerability has a CVSS score of 6.5, indicating a medium severity level. Fixed versions are 2.0.10 and 3.0.7.

CVE-2026-114531 is a stored cross-site scripting (XSS) vulnerability in the Drupal Swiper formatter module. It affects versions from 0.0.0 up to but not including 2.1.2, and from 3.0.1 up to but not including 3.1.0. The vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. The issue has been fixed in versions 2.1.2 and 3.1.0.

CVE-2026-107260 is a stored cross-site scripting (XSS) vulnerability in the Drupal Sector Distribution. It affects versions from 0.0.0 up to 10.3.3 and from 10.4.0 up to 10.4.2. The vulnerability involves improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. This flaw has a CVSS score of 6.5, indicating a medium severity level. Fixed versions are 10.3.3 and 10.4.2.

CVE-2026-114532 is a Cross-site Scripting (XSS) vulnerability in the Drupal UI Icons component. It affects versions from 0.0.0 up to but not including 1.1.3, and from 2.0.0 up to but not including 2.0.2. The vulnerability arises from improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts. The issue has been fixed in versions 1.1.3 and 2.0.2.

CVE-2026-114534 is a stored cross-site scripting (XSS) vulnerability in the Drupal Block Attributes module. It affects versions from 0.0.0 up to but not including 2.1.0. The vulnerability arises from improper neutralization of input during web page generation, allowing an attacker with certain privileges to inject malicious scripts. The issue has been fixed in version 2.1.0.

CVE-2026-114536 is a stored cross-site scripting (XSS) vulnerability in Drupal USWDS Paragraph Components. It affects versions from 0.0.0 up to but not including 3.1.3. The vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The issue has been fixed in version 3.1.3. The CVSS score is 6.5, indicating a medium severity level.

CVE-2026-114538 is a Cross-Site Scripting (XSS) vulnerability in the Drupal Bootstrap theme. It affects Bootstrap versions from 0.0.0 up to but not including 3.45.0. The vulnerability involves improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. A fix is available in version 3.45.0.

CVE-2026-114555 is a stored cross-site scripting (XSS) vulnerability in the Drupal Data field module. It affects versions from 0.0.0 up to but not including 2.0.14. The vulnerability arises from improper neutralization of input during web page generation, allowing malicious scripts to be stored and executed in users' browsers. The issue has been fixed in version 2.0.14. The CVSS score is 3.5, indicating a low severity impact with limited confidentiality and integrity impact and no availability impact.

CVE-2026-118560 is a Cross-site Scripting (XSS) vulnerability in the Drupal Commerce Stripe module. It affects versions from 2.0.0 up to but not including 2.2.3. The vulnerability involves improper neutralization of input during web page generation, which could allow an attacker to inject malicious scripts. The issue has been fixed in version 2.2.3.

CVE-2026-118545 is a Cross-Site Scripting (XSS) vulnerability in the Drupal AI (Artificial Intelligence) product. It affects versions from 0.0.0 up to but not including 1.4.11, and from 1.5.0 up to but not including 1.5.2. The vulnerability involves improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts. The issue has been fixed in versions 1.4.11 and 1.5.2.

CVE-2026-118546 is a Cross-Site Scripting (XSS) vulnerability in the Drupal AI (Artificial Intelligence) product. It affects versions from 0.0.0 up to but not including 1.4.11, and from 1.5.0 up to but not including 1.5.2. The vulnerability involves improper neutralization of input during web page generation, which can lead to XSS attacks. The issue has been fixed in versions 1.4.11 and 1.5.2.

CVE-2026-118549 is a Cross-site Scripting (XSS) vulnerability in the Drupal AI (Artificial Intelligence) product. It affects versions from 0.0.0 up to but not including 1.4.11, and from 1.5.0 up to but not including 1.5.2. The vulnerability involves improper neutralization of input during web page generation, which could allow an attacker to execute arbitrary scripts in the context of the affected application. The issue has been fixed in versions 1.4.11 and 1.5.2.

CVE-2026-118552 is a Cross-Site Scripting (XSS) vulnerability in the Drupal AI (Artificial Intelligence) module. It affects versions from 0.0.0 up to but not including 1.4.11, and from 1.5.0 up to but not including 1.5.2. The vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The issue has been fixed in versions 1.4.11 and 1.5.2.

CVE-2026-118553 is a stored cross-site scripting (XSS) vulnerability in the Drupal AI (Artificial Intelligence) product. It affects versions from 0.0.0 up to but not including 1.4.11, and from 1.5.0 up to but not including 1.5.2. The vulnerability involves improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. The issue has been fixed in versions 1.4.11 and 1.5.2.

CVE-2026-118575 is a stored cross-site scripting (XSS) vulnerability in the Drupal Signature pad widget. It affects versions from 0.0.0 up to but not including 1.15.0. The vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker to inject malicious scripts. The issue has been fixed in version 1.15.0.

CVE-2026-118576 is a Cross-site Scripting (XSS) vulnerability in the Drupal Stage File Proxy module. It affects versions from 0.0.0 up to but not including 3.1.7, and from 4.0.0 up to but not including 4.0.1. The vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker to inject malicious scripts. The issue has been fixed in versions 3.1.7 and 4.0.1.

CVE-2026-61719 is a stored cross-site scripting (XSS) vulnerability in the WeGIA web manager for charitable institutions. Versions prior to 3.8.7 allow attackers with access to patient medical records to inject arbitrary HTML or JavaScript into the textoProntuario field. This malicious script executes when other users view the affected medical record page, potentially leading to session cookie theft and account compromise. The vulnerability is fixed in version 3.8.7.