Diba Carousel Slider CVE-2026-96382

Exploitation requires an authenticated Drupal account holding permissions to create or edit content rendered by the Diba carousel slider module (PR:L), and it requires a second user to view the page containing the stored payload for the script to execute (UI:R) - the XSS does not self-trigger. The specific unsanitized field or input is not identified in the available sources beyond the CWE-79 'improper neutralization during web page generation' classification. Limiting factors: the attacker must already possess content-submission privileges, the victim interaction is mandatory, impact is scoped to the browser context (C:L/I:L, no availability impact), and only Diba carousel slider versions 0.0.0 through 3.0.2 are affected.

This is a moderate-severity stored XSS (CVSS 4.6) in the Drupal contrib module 'Diba carousel slider', and the signals are internally consistent rather than conflicting. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N indicates a network-reachable but authenticated (PR:L) attacker whose payload only fires when another user interacts with the affected page (UI:R), with limited confidentiality and integrity impact and no availability impact - classic stored XSS economics. No EPSS score and no KEV listing are present in the input, and no public exploit reference is supplied, so exploitation is not demonstrated to be widespread or automated. The vuln.today decision label is 'this_month', which reflects a real but non-emergency priority: it should be remediated on a normal patch cadence rather than treated as an active-exploitation fire drill. The practical risk is bounded by the requirement for an authenticated contributor-level account and for a victim to view the malicious content; this makes it most relevant to multi-user Drupal sites where lower-trust authors can submit carousel content viewed by administrators or other users.

An attacker with a low-privileged authenticated Drupal account that can create or edit Diba carousel slider content injects a malicious script into an insufficiently sanitized slider field. The stored payload later executes in the browser of any user - potentially an administrator - who views the page containing the carousel, enabling session or action hijacking in that victim's context. No public exploit code is identified in the provided sources.