Component Blocks
Monthly
Stored cross-site scripting in the Drupal contributed 'Component blocks' module (versions 0.0.0 through 1.2.6) lets an authenticated user who holds permission to create or edit component blocks persist malicious script that executes in the browser of any user viewing the poisoned block, including administrators. Rated CVSS 4.6 with a PR:L/UI:R profile, so exploitation needs both a block-authoring account and a victim who loads the rendered content; Drupal core and sites without the module are unaffected. No public exploit code or active exploitation has been identified at time of analysis, and EPSS is 0.16% (5th percentile), consistent with a low-to-moderate real-world priority and a 'this month' patch cadence rather than an emergency.
Stored cross-site scripting in the Drupal contributed 'Component blocks' module (versions 0.0.0 through 1.2.6) lets an authenticated user who holds permission to create or edit component blocks persist malicious script that executes in the browser of any user viewing the poisoned block, including administrators. Rated CVSS 4.6 with a PR:L/UI:R profile, so exploitation needs both a block-authoring account and a victim who loads the rendered content; Drupal core and sites without the module are unaffected. No public exploit code or active exploitation has been identified at time of analysis, and EPSS is 0.16% (5th percentile), consistent with a low-to-moderate real-world priority and a 'this month' patch cadence rather than an emergency.