CVE-2026-84915

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Component blocks allows Stored XSS. This issue affects Component blocks versions: from 0.0.0 to 1.2.7...

CVE-2026-84915

The Component blocks module for Drupal (versions 0.0.0 through 1.2.7 ) is vulnerable to Stored Cross-site Scripting (XSS) . The root cause is the insufficient validation of user input before it is processed during token replacement . Practical exploitation requires the attacker to possess a role ...

EUVD-2026-107876

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Component blocks allows Stored XSS. This issue affects Component blocks versions: from 0.0.0 to 1.2.7...

CVE-2026-84915 Component blocks - Moderately critical - Cross site scripting - SA-CONTRIB-2026-123

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Component blocks allows Stored XSS. This issue affects Component blocks versions: from 0.0.0 to 1.2.7...

CVE-2026-84915 Component blocks - Moderately critical - Cross site scripting - SA-CONTRIB-2026-123

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Component blocks allows Stored XSS. This issue affects Component blocks versions: from 0.0.0 to 1.2.7...

Component blocks - Moderately critical - Cross site scripting - SA-CONTRIB-2026-123

This module enables you use UI Patterns with blocks, for use in Layout Builder. The module doesn't sufficiently validate user input before passing to token replacement. This vulnerability is mitigated by the fact that an attacker must have a role with the ability to edit layout builder layouts...