CVE-2026-96382

Name of the Vulnerable Software and Affected Versions Drupal Diba carousel slider versions 0.0.0 through 3.0.2

Description Stored Cross-site Scripting (XSS) occurs when the "Allow HTML description" option is enabled. In this configuration, slide descriptions are rendered using the raw stored field value instead of the rendered output, which bypasses Drupal's text format filtering and output sanitization mechanisms. This issue specifically affects sites using a formatted text field as the carousel description source with the mentioned option enabled.

Recommendations Update Drupal Diba carousel slider to a version later than 3.0.2. Disable the "Allow HTML description" option to prevent the bypass of output sanitization.