CVE-2026-96363 affects Webform Entity Print, an optional submodule in Drupal’s contributed Webform project—not Drupal core. Drupal.org says the exposure arises when that submodule is enabled and a user who can create webforms exploits cross-site scripting (XSS) in its settings. Site owners should check the submodule and installed Webform version against the current advisory’s solution section; a Drupal core update alone is not the stated fix.
Is CVE-2026-96363 a Drupal core vulnerability?
No. Drupal.org lists CVE-2026-96363 as a contributed-project advisory for Webform, and explicitly states that Drupal core is not affected. Drupal’s security listings distinguish contributed-project advisories from core advisories; that distinction identifies the affected project, but does not mean an affected site is safe or exempt from remediation.
As an Amazon Associate I earn from qualifying purchases.
The advisory is SA-CONTRIB-2026-161, titled “Webform – Moderately critical – Cross-site scripting.” It is dated September 23, 2026, and Drupal’s Security Team assigns it a score of 10/25. That is an advisory risk rating, not a measure of how many sites are affected or whether the vulnerability is being exploited.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Which Drupal component is affected, and how does the issue arise?
The named component is Webform Entity Print, a submodule included with the contributed Webform project. Drupal.org describes insufficient access limits around print templates. When Webform Entity Print is enabled, a user with permission to create a webform can exploit XSS in the submodule’s settings.
#1 Best Overall
This describes a conditional exposure, not a claim that every Drupal site or every Webform installation is vulnerable. The relevant checks are whether the submodule is enabled and whether accounts have the stated webform-creation capability. The advisory’s listed risk vector also includes complex attack conditions and administrator-level privilege; consult the full advisory for the complete rating context.
How should a site owner check and respond?
- Check component state. Determine whether Webform Entity Print is enabled on the site. The advisory’s described condition depends on this submodule being enabled.
- Review account capabilities. Identify roles and accounts that can create webforms, the capability named in the advisory’s XSS scenario.
- Compare the installed release with the advisory. Open SA-CONTRIB-2026-161 and use its affected-version and solution details to determine the required Webform update. Do not infer a version range from a different Webform advisory.
- Apply and verify the advisory’s stated solution. Confirm the site follows the current solution section for this contributed module; do not assume that updating Drupal core addresses the issue.
The Drupal.org listing available here establishes the issue and its described condition, but does not provide the affected-release range or fixed release. Therefore, no specific version number can be stated safely without checking the complete advisory.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What does “not Drupal core” mean for maintenance?
It means the vulnerability is assigned to Webform Entity Print within the contributed Webform project, rather than to Drupal core. Drupal’s core security advisory listing is separate from its contributed-project listings. A core-only update should not be treated as proof that a contributed module is patched: verify the Webform release and remediation against SA-CONTRIB-2026-161.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Rank #4
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
