Drupal Feed Block CVE-2026-87939

Exploitation requires an authenticated account with sufficient privilege to supply or configure content rendered by the Feed Block module (PR:L) on Drupal sites running Feed Block versions below 2.0.2 (3.x branch below 3.0.2). The stored payload executes when another user renders the affected block, so delivery to a victim depends on that victim viewing a page containing the compromised block. Limiting factors: it is not remotely exploitable by fully unauthenticated attackers (PR:L), the reporter assigns high attack complexity (AC:H) though the specific precondition is not described in the available sources, and sites not using the Feed Block contrib module are unaffected. Impact is bounded to Low confidentiality and Low integrity in the victim's browser context with no availability impact.

This is a low-to-moderate priority issue, not an emergency. The signals are internally consistent and point to limited real-world risk: CVSS 3.1 base score is 4.2 (Medium) with AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N, meaning network-reachable but low privileges required (PR:L - an authenticated user), only Low confidentiality and integrity impact, and no availability impact. EPSS reinforces this with a 0.16% exploitation probability (5th percentile), among the lowest tiers. The vulnerability is NOT in CISA KEV, so there is no confirmed active exploitation. No exploit code or PoC reference is present in the input - the only references are the Drupal security advisory (SA-contrib-2026-137) and the NVD detail page, so this is 'no public exploit identified at time of analysis.' The vuln.today decision label is 'this_month,' consistent with a Medium-severity, patch-available, low-EPSS stored XSS rather than an act-now situation. One caveat: this is a contrib (community) Drupal module, so the practical blast radius depends entirely on how many sites install Feed Block and grant the relevant content-authoring role. The CVSS AC:H (high attack complexity) is asserted by the reporter but the input does not describe WHY the attack is complex; treat the mechanism as unstated.

An attacker holding a low-privileged authenticated account with rights to configure or supply content to a Feed Block (for example a content editor or feed source) injects a malicious script payload that is stored and later rendered unsanitized to other users. When a victim - potentially an administrator - views a page containing the block, the script executes in their browser session. No public exploit code is identified at time of analysis; the attack requires authenticated access (PR:L) and the reporter rates attack complexity as high (AC:H), though the trigger is not described in the available sources.