PT-2026-69023

CVE-2026-18986

Published

2026-08-05

Updated

2026-09-02

Description by

CVSS 3.1

4.8

Medium

MetricsAV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Drupal Entity Browser versions 0.0.0 through 2.16.0

Description Stored cross-site scripting (XSS) occurs because the module does not sufficiently sanitize tab titles. This allows an attacker to insert HTML with specific attributes on a page displaying an entity browser. Cross-site scripting is a flaw where malicious scripts are injected into trusted websites.

Recommendations Update Drupal Entity Browser to a version later than 2.16.0.

Exploitability

Fix

Impacts

Researchers

Vendors

Affected products