PT-2026-84895

CVE-2026-84919

Published

2026-09-02

Updated

2026-10-22

Description by

CVSS 3.1

4.6

Medium

MetricsAV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery versions 0.0.0 through 5.0.9

Description Stored Cross-site Scripting (XSS) occurs because the module does not sufficiently sanitize user-supplied input, such as image alt tags, within its dynamic caption script. This allows an attacker with a role permitted to enter HTML content to execute malicious scripts. Cross-site Scripting is a flaw where malicious scripts are injected into trusted websites.

Recommendations Update Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery to a version later than 5.0.9.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products