CVE-2026-6095

Name of the Vulnerable Software and Affected Versions Drupal Orejime versions 0.0.0 through 2.0.15

Description Improper neutralization of input during web page generation allows Cross-Site Scripting (XSS). The IframeConsent element writes HTML attributes without escaping their values. An attacker with a role that permits creating or modifying content in a field using a text format that enables iframe-consent HTML tags with alt attributes (specifically the Enable JS Iframe consent option) can insert arbitrary JavaScript by writing an <iframe-consent> tag.

Recommendations Update to version 2.0.16. Restrict the use of text formats that allow iframe-consent HTML tags to authorized users only.