What is the CVSS score of CVE-2026-11913?

CVE-2026-11913 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Mother May I are affected by CVE-2026-11913?

The Drupal 'Mother May I' contributed module contains a stored and reflected cross-site scripting vulnerability (CVSS 9.8) affecting all released versions that enables script injection in user…

How to fix or mitigate CVE-2026-11913?

Within 24 hours: Audit all Drupal installations to identify systems where the 'Mother May I' module is active and document affected environments. Within 7 days: Disable or uninstall the 'Mother May I' module on all production Drupal instances unless business-critical functionality depends on it; if required for operations, implement strict input validation and output encoding, and deploy Web Application Firewall (WAF) rules configured to block common XSS payloads. Within 30 days: Monitor the Drupal module vendor's security advisories for patch availability and develop a remediation plan for module re-enablement only after a security fix is released; conduct security awareness training emphasizing risks from credential compromise should unpatched systems remain in production.

Mother May I CVE-2026-11913

EUVD-2026-43093 CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2026-07-10 drupal

GHSA-44mv-pf85-f9px

XSS Drupal Mother May I

9.8

CVSS 3.1 · Vendor: drupal

Severity by source

Vendor (drupal) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

5.4 MEDIUM

Typical stored XSS: network vector, low complexity, UI:R because a victim must view the payload, S:C into the browser, low C/I and no A; PR:L assumes some access to submit input.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (drupal).

CVSS VectorVendor: drupal

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 19:32 vuln.today

CVSS changed

Jul 13, 2026 - 19:22 NVD

9.8 (CRITICAL)

CVE Published

Jul 10, 2026 - 22:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 10, 2026 - 22:00 cve.org

CRITICAL 9.8

DescriptionCVE.org

vulnerability in Drupal Mother May I allows . This issue affects Mother May I versions: *.*.

AnalysisAI

Stored/reflected cross-site scripting (CWE-79) affects the Drupal contributed module 'Mother May I' across all released versions (*.*), letting attackers inject script that executes in the browser context of other Drupal users. Because the module is a Drupal add-on rather than core, exposure is limited to sites that have installed it, and no public exploit has been identified. EPSS is low (0.15%, 5th percentile) and the flaw is not on the CISA KEV list, indicating no known active exploitation despite the vendor-assigned 9.8 rating.

Technical ContextAI

Mother May I is a contributed access-control/permissions helper module for the Drupal CMS (PHP), identified by CPE cpe:2.3:a:drupal:mother_may_i. The weakness is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-supplied input is rendered into HTML output without adequate sanitization or output encoding, allowing arbitrary HTML/JavaScript to run in a victim's session. In Drupal, such flaws typically arise when module code emits values via unsafe render paths instead of Drupal's built-in Twig auto-escaping or sanitization APIs (Html::escape, Xss::filter, #plain_text). The Drupal Security Team advisory SA-CONTRIB-2026-045 is the authoritative source for this contrib module.

RemediationAI

Patch available per vendor advisory - consult the Drupal Security Team advisory at https://www.drupal.org/sa-contrib-2026-045 for the fixed release and upgrade to the patched version of the Mother May I module (an exact fixed version number is not present in the provided data, so confirm it directly from the advisory before deploying). If a patched release is not yet installable or the module is no longer maintained, the safest compensating control is to uninstall/disable the Mother May I module, since it is an optional contrib add-on (trade-off: loss of whatever permission-gating functionality it provides). Where the module must stay enabled, restrict access to the pages/forms that render its input to trusted authenticated roles and place them behind authentication, and consider a WAF/CSP rule that constrains inline script execution to blunt XSS payloads (trade-off: CSP tuning may break legitimate inline scripts and does not fix the underlying flaw). Track vuldb.com/vuln/377663 and the EUVD record for a confirmed fixed version.