{"id":"CVE-2026-55805","published":"2026-08-25T22:22:20Z","modified":"2026-08-26T17:49:10Z","title":"Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-012","vendor":"Drupal","product":"Drupal core","tier":"tail","description":{"text":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Drupal core allows Stored XSS. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*, from 0.0.0 to 11.2.*.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.4,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.00226,"percentile":0.13341,"provenance":"source"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://www.drupal.org/sa-core-2026-012","tags":[]}],"priority":{"score":6.4,"factors":[{"name":"EPSS percentile","points":2.67},{"name":"CVSS severity","points":3.78}]},"vendorSlug":"drupal","affectedVersions":[{"vendor":"Drupal","product":"Drupal core","versions":[">= 0.0.0, < 10.6.13",">= 11.3.0, < 11.3.14",">= 11.4.0, < 11.4.4",">= 0.0.0, < 11.0.*",">= 0.0.0, < 11.1.*",">= 0.0.0, < 11.2.*"]}],"affected":[{"ecosystem":"Packagist","package":"drupal/core","vulnerableRanges":["<10.6.13",">=11.3.0, <11.3.14",">=11.4.0, <11.4.4",">=11.0.0, <11.1.0",">=11.1.0, <11.2.0",">=11.2.0, <11.3.0"],"patched":["10.6.13","11.3.14","11.4.4","11.1.0","11.2.0","11.3.0"],"from":["DRUPAL-CORE-2026-012"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-66183","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-drupal-core-cve-2026-55805","packageHistory":[{"cve":"CVE-2026-55808","published":"2026-07-10","fixed":"11.3.12","kev":false},{"cve":"CVE-2026-15916","published":"2026-08-25","fixed":"11.4.4","kev":false},{"cve":"CVE-2026-15917","published":"2026-08-25","fixed":"11.4.4","kev":false},{"cve":"CVE-2026-55805","published":"2026-08-25","fixed":"11.4.4","kev":false},{"cve":"CVE-2026-108097","published":"2026-10-30","fixed":"12.0.0-beta2","kev":false,"link":{"from":"CVE-2026-55805","to":"CVE-2026-108097","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:drupal/core","fromFixed":"10.6.13","toFixed":"10.6.19","daysApart":66},{"kind":"version-step","provenance":"source","package":"Packagist:drupal/core","fromFixed":"11.3.14","toFixed":"11.3.19","daysApart":66}]}},{"cve":"CVE-2026-108514","published":"2026-10-30","fixed":"12.0.0-beta2","kev":false,"link":{"from":"CVE-2026-55805","to":"CVE-2026-108514","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:drupal/core","fromFixed":"10.6.13","toFixed":"10.6.19","daysApart":66},{"kind":"version-step","provenance":"source","package":"Packagist:drupal/core","fromFixed":"11.3.14","toFixed":"11.3.19","daysApart":66},{"kind":"similar","provenance":"machine","score":0.6,"basis":"same product + CWE + description similarity"}]}},{"cve":"CVE-2026-108515","published":"2026-10-30","fixed":"12.0.0-beta2","kev":false,"link":{"from":"CVE-2026-55805","to":"CVE-2026-108515","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:drupal/core","fromFixed":"10.6.13","toFixed":"10.6.19","daysApart":66},{"kind":"version-step","provenance":"source","package":"Packagist:drupal/core","fromFixed":"11.3.14","toFixed":"11.3.19","daysApart":66},{"kind":"similar","provenance":"machine","score":0.6,"basis":"same product + CWE + description similarity"}]}}],"package":"Packagist:drupal/core"}}