Medium severity5.4NVD Advisory· Published Jul 10, 2026· Updated Jul 14, 2026
CVE-2026-58591
CVE-2026-58591
Description
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Colorbox allows Cross-Site Scripting (XSS). This issue affects Colorbox versions: from 0.0.0 to 2.1.5, from 0.0.0 to 2.2.0.
Affected products
4- Package: https://wordpress.org/plugins/drupal
cpe:2.3:a:colorbox_project:colorbox:*:-:*:*:*:drupal:*:*+ 1 more
- cpe:2.3:a:colorbox_project:colorbox:*:-:*:*:*:drupal:*:*range: <2.1.5
- cpe:2.3:a:colorbox_project:colorbox:2.2.0:-:*:*:*:drupal:*:*
Patches
Vulnerability mechanics
References
1- www.drupal.org/sa-contrib-2026-069nvdThird Party Advisory
News mentions
1- Drupal: Five Security Advisories Disclosed Together on July 1, 2026Vypr Intelligence · Jul 1, 2026