CVE-2026-96371

Name of the Vulnerable Software and Affected Versions Drupal Webform versions 0.0.0 through 6.2.12 Drupal Webform versions 6.3.0 through 6.3.1

Description Stored Cross-Site Scripting (XSS) occurs when the module does not sufficiently restrict access to raw webform source editing while the Webform UI module is disabled. This allows a user with permissions to create or edit webforms to input source configuration that is rendered unsafely. Stored XSS is a security flaw where a malicious script is permanently stored on the target server and executed in the browser of users who view the affected page.

Recommendations Update Drupal Webform to a version later than 6.2.12. Update Drupal Webform to a version later than 6.3.1.