medium · CVSS v3 6.1

CVE-2026-84924

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Email Verif…

Description

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Reflected XSS. This issue affects Email Verification / SMS Verification / OTP Verification versions: from 0.0.0 to 2.4.0.

Scores

Severity
medium
CVSS v2
3.5
CVSS v3
6.1
CVSS v4
—
EPSS
—

← All CVEs

Related CVEs

medium

CVE-2026-87937

Drupal Central Authentication System (CAS) Server has an open redirect vulnerability that allows attackers to redirect users to malicious sites. The flaw exists in versions 0.0.0 through 2.0.4 and 2.1.0 through 2.1.3. It can be exploited without authentication, potentially compromising user trust and session integrity.

View analysis

medium

CVE-2026-84919

Drupal PhotoSwipe plugin has a stored XSS flaw that can be triggered by malicious input in image captions or metadata. Attackers can inject scripts that execute in the browser of any user viewing the gallery, potentially leading to session hijacking or defacement.

View analysis

medium

CVE-2026-84915

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Component blocks allows Stored XSS. This issue affects Component blocks versions: from 0.0.0 to 1.2.7.

View analysis

medium

CVE-2026-84911

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Stored XSS. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.3.13, from 1.4.0 to 1.4.8.

View analysis