Drupal Component Blocks EUVD-2026-107876

Exploitation requires the 'Component blocks' contributed module (versions 0.0.0 through 1.2.6) to be installed on the Drupal site, plus an authenticated account holding permission to create or edit Component blocks content (CVSS PR:L) to persist the malicious payload. Triggering further requires a second user to view the page rendering the poisoned block (CVSS UI:R) - the stored script does not execute until the content is viewed. Limiting factors: this is a contributed/add-on module rather than Drupal core, so sites without it are unaffected; the attacker must already possess block-authoring privileges; and a victim must load the affected content. Impact escalates most when the viewing victim is a higher-privileged user such as an administrator. The precise injection point and sanitization gap are not detailed in the available sources beyond the CWE-79 classification.

This is a moderate-severity stored XSS (CVSS 4.6) in the Drupal contributed 'Component blocks' module, and the signals are internally consistent in pointing to a LOW-to-MODERATE real-world priority rather than an urgent threat. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) indicates remote reachability but requires an authenticated account (PR:L) with privileges to author block content and requires a victim to view the poisoned page (UI:R), with only partial confidentiality and integrity impact and no availability impact. EPSS is very low at 0.16% (5th percentile), SSVC reports Exploitation: none, Automatable: no, and Technical Impact: partial, and the vulnerability is NOT in CISA KEV. These exploitation signals agree with each other: no evidence of active exploitation and no automation potential. The vuln.today decision label 'this_month' reflects a patch-on-normal-cadence posture rather than emergency. The one counterweight is that stored XSS in a CMS can be leveraged to hijack the session of a higher-privileged user (e.g., an administrator) who views the content, which can escalate real impact beyond the CVSS-stated 'Low' - this is why it should not be dismissed outright. No separate PoC or exploit reference is provided in the input; the only references are the vendor security advisory and an NVD detail page. Net assessment: a genuine issue worth patching on a normal monthly cycle, not a high-CVSS-but-illusory risk, but also not an emergency given low EPSS, no KEV, and the authentication plus user-interaction prerequisites.

An attacker who holds (or phishes/registers) a Drupal account with permission to create or edit Component blocks stores a malicious script payload within block content. When another user - potentially a site administrator - views a page rendering that block, the script executes in their browser session, enabling session/cookie theft or actions performed as the victim. No public exploit code is identified in the provided data, and exploitation requires both the authenticated authoring privilege and a victim viewing the content.