Medium severity5.4NVD Advisory· Published Aug 25, 2026· Updated Aug 26, 2026
CVE-2026-55805
CVE-2026-55805
Description
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Stored XSS. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*, from 0.0.0 to 11.2.*.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*, from 0.0.0 to 11.2.*
Patches
Vulnerability mechanics
References
1News mentions
1- Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-012Drupal Security Advisories · Jul 15, 2026