Drupal Webform CVE-2026-96357

Exploitation requires an authenticated Drupal account with sufficient privilege to submit or configure Webform content on a site running Webform between 0.0.0 and 6.2.12, or between 6.3.0 and 6.3.1 (per CVSS PR:L). Because this is stored XSS, the payload only executes when a second user - typically a site administrator or form reviewer - subsequently views the stored content (per CVSS UI:R); there is no execution at submission time. These two preconditions (an injection-capable account plus a victim viewing the stored data) are the primary limiting factors and substantially reduce realistic risk relative to an unauthenticated, no-interaction flaw. The specific Webform field or rendering context that fails neutralization is not detailed in the available sources.

This is a stored cross-site scripting flaw (CWE-79) with a vendor-assigned CVSS of 4.6 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N), placing it firmly in the medium band. The signals are internally consistent and point to a real-but-non-urgent issue rather than a top priority. The vector shows network reachability and low complexity, but two factors meaningfully constrain it: PR:L means an authenticated account with at least some privilege to inject content is required, and UI:R means a victim must view the stored payload for it to fire. EPSS is low at 0.17% (6th percentile), and the vulnerability is NOT in CISA KEV, so there is no evidence of active exploitation - exploitation status is best described as no public weaponized exploit confirmed, though a public PoC reference exists (see confidence_notes). The vuln.today decision label is 'this_month', consistent with a medium-severity authenticated stored XSS that should be patched on a normal cycle rather than as an emergency. The only mild tension is network attack vector paired with the authentication and user-interaction prerequisites, which is normal and expected for stored XSS and not a contradiction. Overall: a legitimate issue to remediate, but not a drop-everything priority given low exploitation probability, no KEV listing, and the authentication/interaction preconditions.

An attacker holding a low-privilege Drupal account that can submit or configure Webform content injects a malicious script into a field that is later rendered without proper neutralization. When a site administrator or another user subsequently views the stored submission or form element, the script executes in their browser session, enabling session-context actions such as limited data disclosure or request forgery. A public PoC reference exists but is not verified as working exploit code; the precise field and trigger are not detailed in the available sources.