Drupal Webform CVE-2026-96359

Exploitation requires a low-privileged authenticated account on the target Drupal site (PR:L) capable of supplying input to a Webform element, plus interaction by a victim user who must load the page where the unneutralized input is rendered (UI:R). The specific webform feature, field type, or configuration that carries the unescaped input is not described in the available sources, so the precise trigger cannot be stated. Limiting factors that reduce real-world risk: the attacker cannot act fully unauthenticated, a second user must view the malicious content for the payload to fire, impact is confined to the victim's browser context (C:L/I:L, no availability impact), and sites on Webform 6.2.12 or 6.3.1+ are not affected.

This is a moderate, not emergency, priority. The CVSS 3.1 base score of 4.6 (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) describes a network-reachable but authenticated (PR:L) cross-site scripting flaw that additionally requires victim user interaction (UI:R) and yields only low confidentiality and integrity impact with no availability impact. All signals point the same direction and are mutually consistent: EPSS is very low at 0.17% (6th percentile), there is no CISA KEV listing (not actively exploited per that source), and exploitation status is no public exploit identified at time of analysis. The vuln.today decision label is 'this_month', consistent with a real-but-non-critical issue that should be patched on a normal cadence rather than an emergency. The combination of required privileges plus required user interaction materially limits automation and mass exploitation, which aligns with the low EPSS. There is no conflict among the signals here; the main caveat is that the description does not specify whether the XSS is stored or reflected, which affects how the UI:R and PR:L prerequisites play out in practice - verify with the Drupal security advisory (SA-contrib-2026-159).

An attacker with a low-privileged authenticated account on a Drupal site (for example, a user permitted to create or submit webforms) injects a crafted script payload into a webform field or element that is later rendered without proper neutralization. When another user - such as a site administrator reviewing submissions - views the affected page, the script executes in their browser session (UI:R), potentially allowing limited theft of session data or UI manipulation. No public exploit code was identified at the time of analysis.