Drupal PhotoSwipe CVE-2026-84919

Exploitation requires an attacker to hold a Drupal account with privileges to submit or edit content handled by the PhotoSwipe - Responsive JavaScript Modal Image Gallery module (CVSS PR:L), and a second user must subsequently view the page containing the stored payload for it to execute (CVSS UI:R). The exact input field, caption, or gallery setting that stores the unsanitized data is not described in the available sources. Limiting factors: this is not remote-unauthenticated - an account with content-contribution rights is a prerequisite, victim interaction is needed, impact is limited to partial confidentiality/integrity in the victim's browser context (no availability impact), and the module is patched (fixed in 5.0.9 per the EUVD range), so updating removes the exposure. Only affected installations are those running PhotoSwipe module versions below 5.0.9.

This is a genuinely low-to-moderate priority issue, and the signals are internally consistent rather than conflicting. The CVSS 3.1 base score of 4.6 (Medium) reflects a stored XSS requiring an authenticated contributor (PR:L) and victim interaction (UI:R), with only partial confidentiality and integrity impact and no availability impact (C:L/I:L/A:N, scope unchanged). All secondary signals reinforce the low urgency: EPSS is 0.16% (5th percentile), SSVC records Exploitation:none, Automatable:no, and Technical Impact:partial, and there is no CISA KEV listing and no public exploit reference in the supplied data. The only mildly elevating signal is the vuln.today 'this_month' decision label, which suggests scheduled remediation rather than emergency action - consistent with a patched, authenticated, interaction-dependent web flaw. In short, this is a real but routine stored-XSS bug in a Drupal contrib module, not a high-urgency threat; the network attack vector (AV:N) overstates exposure because PR:L and UI:R meaningfully constrain exploitation.

An attacker who already holds a low-privileged Drupal account with permission to create or edit gallery content submits an image/node containing a crafted script payload that is stored by the PhotoSwipe module and not properly neutralized. When another user - for example an administrator or site visitor - views the affected gallery page, the stored script executes in their browser session in the context of the site. No public exploit code is identified at the time of analysis.