Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96357
NONE
EPSS 0.17%
Updated Oct 22, 2026
Drupal
CVE Details
CVE ID
CVE-2026-96357
Published Date
Oct 22, 2026
Vendor
Drupal
Severity
NONE
Exploit Prediction (EPSS)
Probability of Exploit
0.17%
Likelihood of exploitation in next 30 days
Percentile:
5.9th percentile (higher than 5.9% of all CVEs)
Standard patching cycle
Impact
Minimal impact
Source
View Advisory