Quick Edit CVE-2026-2348

While CVSS and EPSS scores are not provided in the intelligence data, the vulnerability's characteristics indicate moderate-to-high real-world risk. The attack vector is network-based and requires user interaction (victims must visit a page controlled or influenced by an attacker), typical of stored or reflected XSS. No explicit KEV (Known Exploited Vulnerability) status or public proof-of-concept code is mentioned in the available references, suggesting this may be a responsible disclosure with limited active exploitation at the time of analysis. However, the presence of a Drupal security advisory (SA-CONTRIB-2026-009) and the ENISA EUVD tracking (EUVD-2026-15451) indicate this is treated as a legitimate security concern by the vendor. The fact that patches exist for both affected version branches (1.0.5+ and 2.0.1+) further confirms remediation is available, reducing the practical risk for organizations that patch promptly. For unpatched systems, the risk is significant because XSS in an administration/editing interface can lead to account compromise, privilege escalation, and data theft from site administrators and editors.

An attacker creates a malicious Drupal post or comment containing XSS payload within a field that Quick Edit renders. When a site administrator or content editor visits the page and hovers over or attempts to use the quick edit interface, the JavaScript payload executes in their browser with their privileges and session cookie, allowing the attacker to steal authentication tokens, modify content, create new admin accounts, or perform other actions as the victim user. This scenario is particularly dangerous because quick edit is typically enabled for administrative users who have higher-level permissions and access to sensitive site configuration.