PT-2026-133273

CVE-2026-118560

Published

2026-10-28

Updated

2026-10-30

Description by

CVSS 3.1

5.1

Medium

MetricsAV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Drupal Commerce Stripe versions 2.0.0 through 2.2.3

Description Improper neutralization of input during web page generation allows for Cross-Site Scripting (XSS). This issue occurs when the module is used to configure the store via the Stripe Connect API. Exploitation requires the attacker to possess administrator permissions to configure payment gateways and the simultaneous compromise of an external service.

Recommendations Update Drupal Commerce Stripe to a version later than 2.2.3.

Exploitability

Exploit

Fix

Impacts

Researchers