PT-2026-120909

CVE-2026-114534

Published

2026-10-21

Updated

2026-10-30

Description by

CVSS 3.1

5.9

Medium

MetricsAV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Drupal Block Attributes versions 0.0.0 through 2.1.0

Description Stored Cross-site Scripting (XSS) occurs because the module does not sufficiently sanitize attributes used to define custom attributes for a block. This allows an attacker with the administer blocks permission to inject malicious scripts into web pages. Cross-site Scripting is a flaw where untrusted data is inserted into a web page without proper validation or encoding, allowing the execution of scripts in the victim's browser.

Recommendations Update Drupal Block Attributes to a version later than 2.1.0. Restrict the administer blocks permission to trusted users only.

Exploitability

Exploit

Fix

Impacts

Researchers