Drupal Webform CVE-2026-96362

The description identifies the flaw as improper neutralization of input during web page generation (XSS) in the Drupal Webform module, but does not name the specific field, form element, or configuration that carries the unsanitized input, so the exact injection point is not described in the available sources. The vendor vector requires victim interaction (UI:R) - a user must load or view the page containing the payload - and rates attack complexity high (AC:H), both of which limit practical exploitation. Impact is bounded to Low confidentiality and Low integrity with no availability effect and unchanged scope. Affected deployments are Drupal sites running Webform below 6.2.12 (0.x-6.2 branch) or the 6.3.0-6.3.1 range; sites on a fixed release are not exposed. Whether an unauthenticated attacker or only an authenticated form editor can inject the payload is not confirmed by the available data.

All signals point to a genuinely low real-world priority despite the CWE-79 label. The vendor CVSS 3.1 vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N) yields only 4.2 (Medium): network-reachable but high attack complexity, required user interaction, unchanged scope, and only Low confidentiality and integrity impact with no availability impact. EPSS reinforces this with a 0.17% exploitation probability at the 5th percentile - very low. The CVE is NOT on CISA KEV, so there is no public evidence of active exploitation, and no public exploit identified at time of analysis (the vuldb and Drupal references are advisories, not verified working exploit code). The vuln.today decision label is 'this_month', i.e. routine patching urgency rather than act_now/emergency, which is consistent with the low EPSS and absence of KEV. The signals are mutually consistent - there is no conflict suggesting hidden severity. One caveat: the vendor vector sets PR:N (no privileges), but the description does not state how the payload is injected or who can inject it, so whether this is a truly unauthenticated reflected XSS or a stored XSS reachable only by an authenticated form editor cannot be confirmed from the available data; this materially affects real exposure and should be verified against the Drupal advisory.

An attacker introduces a crafted script payload into a Webform field or configuration that is not properly neutralized during web page generation; a victim who later loads the affected page executes the attacker's JavaScript in their browser session, enabling limited session/UI manipulation. Exploitation requires the victim to interact with the malicious content and the vendor rates attack complexity as high, so it is not a drive-by. No public exploit identified at time of analysis.