EUVD-2026-66183
GHSA-vqm5-mjxv-776v
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
PR:L confirmed by need for authenticated low-privilege content submission; UI:R and S:C reflect stored XSS executing in a victim's browser session.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
4DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Stored XSS. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*, from 0.0.0 to 11.2.*.
AnalysisAI
Stored XSS in Drupal Core allows authenticated low-privileged users to inject persistent malicious scripts that execute in the browsers of other site visitors, including administrators. The vulnerability spans multiple Drupal release trains - 10.x through 10.6.x, and all 11.0.*, 11.1.*, and 11.2.* branches - and is addressed in patched releases 10.6.13, 11.3.14, and 11.4.4 per the vendor advisory SA-core-2026-012. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two conditions to align: first, an attacker must hold a low-privileged authenticated account on the target Drupal site with permission to create or edit content (e.g., contributor, editor, or any role with node/comment create permissions) - sites with open user registration are more exposed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 5.4 (Medium) reflects genuine constraints: PR:L requires an authenticated low-privileged user to submit the payload, and UI:R means a second user must browse the affected content before the payload fires - ruling out automated mass exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to upgrade Drupal Core to a patched release: 10.6.13 for the 10.x train, 11.3.14 for the 11.3.x train, or 11.4.4 for the 11.4.x train, as documented in https://www.drupal.org/sa-core-2026-012. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Drupal Core
View allSQL injection in Drupal core (versions 8.9.0 through the fixed 10.4.10/10.5.10/10.6.9 and 11.x branches through 11.3.10)
Object injection in Drupal Core across branches 8.0.0 through 11.3.x allows a network-accessible, highly privileged auth
Cross-site scripting in Drupal core 11.3.0 through 11.3.6 enables unauthenticated remote attackers to inject malicious s
Cross-site scripting in Drupal Core exposes a broad range of Drupal installations - spanning major versions 8 through 11
Object injection in Drupal Core through improperly controlled modification of dynamically-determined object attributes (
Object injection via a mass assignment flaw in Drupal Core enables an authenticated administrator to manipulate dynamica
Open redirect in Drupal Core across multiple major release branches enables phishing and content spoofing attacks by for
Cross-site scripting (XSS) in Drupal Core affects a broad swath of the 10.x and 11.x release lines, enabling an authenti
Cross-site scripting in Drupal Core across all maintained 11.x release branches allows network-accessible unauthenticate
Forceful Browsing in Drupal Core across multiple active and end-of-life release branches (10.x through 10.6.13, 11.3.x t
Server-Side Request Forgery in Drupal Core allows authenticated low-privilege users to coerce the application server int
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today