Entity Browser
Monthly
Stored cross-site scripting in the Drupal Entity Browser contributed module (versions prior to 2.16.0) allows a high-privileged authenticated attacker to inject persistent malicious script payloads that execute in victims' browsers when affected pages are loaded. The scope change (S:C in the CVSS vector) confirms the injected script crosses into the victim's browser context, enabling session hijacking or credential theft against users who view affected content. No public exploit code or active exploitation has been identified; the vendor (Drupal Security Team) has released a patched version and published advisory SA-CONTRIB-2026-094.
Stored cross-site scripting in the Drupal Entity Browser contributed module (versions prior to 2.16.0) allows a high-privileged authenticated attacker to inject persistent malicious script payloads that execute in victims' browsers when affected pages are loaded. The scope change (S:C in the CVSS vector) confirms the injected script crosses into the victim's browser context, enabling session hijacking or credential theft against users who view affected content. No public exploit code or active exploitation has been identified; the vendor (Drupal Security Team) has released a patched version and published advisory SA-CONTRIB-2026-094.