Drupal Webform CVE-2026-96361

Exploitation requires an authenticated account with at least low privileges on the target Drupal site (PR:L) and requires a separate victim to interact with the maliciously generated page (UI:R) for the injected script to execute. The specific input field, Webform feature, or configuration that permits the improper neutralization is not described in the available sources, so the exact trigger is unverified. Limiting factors that reduce real-world risk: the attacker cannot act fully unauthenticated, a second user must view the affected content, impact is confined to the victim's browser session (scope unchanged, no availability impact), and only Webform versions below 6.2.12 (6.2.x branch) and below 6.3.1 (6.3.x branch) are affected.

This is a moderate-severity stored/reflected Cross-Site Scripting issue (CVSS 4.6, CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) in the Drupal Webform contributed module. The signals are internally consistent and point to a real-but-not-urgent issue rather than an emergency: the vector is network-reachable with low attack complexity, but it requires an authenticated low-privilege account (PR:L) AND victim user interaction (UI:R), and the impact is limited (C:L/I:L, no availability impact, scope unchanged). EPSS is low at 0.21% (10th percentile), there is no CISA KEV listing, and no verified working exploit code is present - only a VulDB advisory reference. The vuln.today priority is 'this_month', which aligns with a patch-on-normal-cadence posture rather than immediate action. No signals conflict: low EPSS, absence of KEV, and the authentication/interaction requirements all reinforce that this is a routine remediation item. The main caveat is that the description does not explain the specific injection point or whether the XSS is stored or reflected, so the realistic blast radius (e.g., whether a low-privilege webform submitter can persist script that executes in an administrator's session) cannot be confirmed from the available data.

An attacker with a low-privilege authenticated account on a Drupal site running a vulnerable Webform version injects a crafted script payload through an input handled by the module; when another user - potentially a site administrator reviewing submissions - loads the affected page, the script executes in their browser session. Because user interaction is required (UI:R), the attacker must lure or wait for a victim to view the malicious content. No verified working exploit code is available; only a VulDB advisory reference exists.