XSS Vulnerability in Gin Admin Theme by Drupal
CVE-2026-110738

Currently unrated

Key Information:

Vendor

Drupal
Status
Gin Admin Theme
Vendor
CVE Published:
30 October 2026

What is CVE-2026-110738?

The Gin Admin Theme for Drupal contains a vulnerability that can lead to Cross-Site Scripting (XSS) attacks. This flaw arises from improper neutralization of input during web page generation, thereby allowing attackers to inject malicious scripts. The versions most impacted include any from 0.0.0 to 4.1.4, and from 5.0.0 to 5.0.16. It is crucial for users of affected versions to apply security updates promptly to mitigate potential exploitation.

Affected Version(s)

Gin Admin Theme 0.0.0 < 4.1.4

Gin Admin Theme 5.0.0 < 5.0.16

References

https://www.drupal.org/sa-contrib-2026-219

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Pablo López (plopesc)
Jürgen Haas (jurgenhaas)
catch (catch)
Damien McKenna
Greg Knaddison (greggles)
Dave Long (longwave)
Mohit Aghera (mohit_aghera)
Jess (xjm)
.