medium · CVSS v3 5.4

CVE-2026-84919

Drupal PhotoSwipe plugin has a stored XSS flaw that can be triggered by malicious input in image captions or metadata. Attackers can inject

Overview

Drupal PhotoSwipe plugin has a stored XSS flaw that can be triggered by malicious input in image captions or metadata. Attackers can inject scripts that execute in the browser of any user viewing the gallery, potentially leading to session hijacking or defacement.

Description

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Stored XSS. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 5.0.9.

Impact

The vulnerability allows attackers to inject arbitrary JavaScript into web pages viewed by users, compromising confidentiality by exfiltrating data, integrity by modifying page content, and availability by potentially disrupting user experience. Defenders should be aware that any site using PhotoSwipe 0.0.0–5.0.9 is at risk.

Remediation

Upgrade PhotoSwipe to version 5.1.0 or later, which sanitizes user input. If upgrade is not immediately possible, configure the web application to escape or strip HTML from image metadata and disable user-editable fields that feed into the gallery.

Risk context

Medium severity (CVSS 5.4) indicates a moderate risk. No EPSS data available, so defenders should treat it as a standard medium‑risk issue and prioritize based on exposure.

Affected products

  • Drupal PhotoSwipe
  • PhotoSwipe Gallery

Scores

Severity
medium
CVSS v2
3.5
CVSS v3
5.4
CVSS v4
—
EPSS
—

Drupal PhotoSwipe XSS Stored XSS CMS Web

← All CVEs

Related CVEs

medium

CVE-2026-87937

Drupal Central Authentication System (CAS) Server has an open redirect vulnerability that allows attackers to redirect users to malicious sites. The flaw exists in versions 0.0.0 through 2.0.4 and 2.1.0 through 2.1.3. It can be exploited without authentication, potentially compromising user trust and session integrity.

View analysis

medium

CVE-2026-84924

Drupal Email Verification, SMS Verification, and OTP Verification modules are vulnerable to reflected XSS, allowing attackers to inject malicious scripts into web pages. This flaw can lead to session hijacking or defacement on affected sites. The issue affects all versions up to 2.4.0.

View analysis

medium

CVE-2026-84915

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Component blocks allows Stored XSS. This issue affects Component blocks versions: from 0.0.0 to 1.2.7.

View analysis

medium

CVE-2026-84911

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Stored XSS. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.3.13, from 1.4.0 to 1.4.8.

View analysis