Cross-site Scripting Vulnerability in USWDS Paragraph Components by Drupal

CVE-2026-114536

What is CVE-2026-114536?

A vulnerability in the USWDS Paragraph Components for Drupal has been identified that allows attackers to inject malicious scripts into web pages. This issue can lead to Stored XSS, where the injected scripts are saved and executed whenever the affected page is loaded. The vulnerability impacts versions ranging from 0.0.0 to 3.1.3, enabling potential exploitation that can compromise user data and site integrity. Proper sanitization and validation of user inputs are essential to mitigate this risk.

References