PT-2026-120911

CVE-2026-114536

Published

2026-10-21

Updated

2026-10-30

Description by

CVSS 3.1

6.5

Medium

MetricsAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Drupal USWDS Paragraph Components versions 0.0.0 through 3.1.3

Description Stored Cross-site Scripting (XSS) occurs because twig templates do not sufficiently sanitize values passed to its markup. This issue requires the attacker to possess a role that allows editing content using the paragraph bundles provided by the module.

Recommendations Update Drupal USWDS Paragraph Components to a version later than 3.1.3.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors