Cross-Site Scripting Vulnerability in Drupal Form Builder by Drupal
CVE-2026-0749

4.8MEDIUM

Key Information:

Vendor

Drupal
Status
Drupal
Vendor
CVE Published:
28 January 2026

What is CVE-2026-0749?

An improper neutralization of input during web page generation in the Drupal Form Builder could allow for the execution of harmful scripts in the context of a user's session. This XSS vulnerability allows an attacker to inject malicious code into web pages viewed by other users, potentially compromising sensitive information, user accounts, and overall website integrity. The range of affected versions necessitates immediate actions to patch and secure installations to mitigate risks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Drupal 7.x-1.0 <= 7.x-1.22

References

https://www.herodevs.com/vulnerability-directory/cve-2026...
third-party-advisory
https://d7es.tag1.com/security-advisories/form-builder-le...
third-party-advisory

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yonatan Offek (poiu)
JSON
.