Drupal Webform CVE-2026-96358

Exploitation requires an authenticated account with at least low-level privileges (PR:L) sufficient to supply input that Webform renders into a generated page, plus victim user interaction (UI:R) - a user must load the page where the unneutralized input is displayed for the script to execute. These two factors (required authentication and required victim interaction) are the principal limiters on real-world exploitability and keep impact scoped to the victim's own session (S:U, C:L/I:L/A:N). The description does not name the specific Webform feature, configuration mode, or field that carries the untrusted input, so the exact trigger is not described in the available sources. Affected deployments are Drupal sites running Webform before 6.2.12, or 6.3.0 before 6.3.1.

This is a moderate-severity stored/reflected Cross-Site Scripting flaw (CVSS 3.1 base 4.6) in the Drupal Webform contributed module. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N indicates network-reachable, low-complexity exploitation that nonetheless requires some level of privilege (PR:L) and victim user interaction (UI:R), with only limited confidentiality and integrity impact and no availability impact. The multi-source signals are mutually consistent and point to a genuinely low real-world risk rather than an emergency: EPSS is 0.20% (10th percentile), there is no CISA KEV listing (i.e., no confirmed active exploitation), and no public exploit code is identified in the provided data - the only vuldb entry is an advisory, not a working exploit. The vuln.today decision label is 'this_month', which aligns with a 'patch on the normal cycle' posture rather than act-now urgency. No key signals conflict here; the main caveat is that the description does not specify whether the XSS is stored or reflected, nor which Webform feature or field carries the untrusted input, so the precise trigger cannot be confirmed from the available sources.

An attacker with a low-privileged authenticated account that can submit or configure content handled by Webform injects a malicious script payload into an input that is later rendered without proper neutralization. When an administrator or another user views the affected page, the script executes in their browser session, enabling limited session/data theft or UI manipulation within the victim's privileges. No public exploit identified at time of analysis; the specific vulnerable field is not described in the available sources.