CVE-2026-96358

Name of the Vulnerable Software and Affected Versions Drupal Contributed Module (affected versions not specified)

Description The Webform module contains a rating element that does not sufficiently validate data. This flaw could allow cross-site scripting (XSS), a technique where malicious scripts are injected into trusted websites, on pages containing a rating element. Exploitation requires the attacker to be able to place crafted HTML markup on the same page as the rating element. Approximately 436,300 instances of Drupal were identified globally as potentially exposed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.