Cross-Site Scripting Vulnerability in Drupal Commerce Stripe
CVE-2026-118560

5.1MEDIUM

Key Information:

Vendor

Drupal
Status
Commerce Stripe
Vendor
CVE Published:
30 October 2026

What is CVE-2026-118560?

The Drupal Commerce Stripe plugin is affected by a Cross-Site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This vulnerability could allow attackers to inject malicious scripts into pages viewed by users, potentially compromising sensitive data and overall application security. This issue impacts versions 2.0.0 through 2.2.3, underscoring the need for developers to apply proper input validation techniques to mitigate such risks.

Affected Version(s)

Commerce Stripe 2.0.0 < 2.2.3

References

https://www.drupal.org/sa-contrib-2026-265

CVSS V3.1

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Brian Willows (hsjbrianwillows)
Ryan Szrama (rszrama)
Tom Ashe (tomtech)
Jonathan Sacksick (jsacksick)
Swan Kalata (akalata)
Greg Knaddison (greggles)
Juraj Nemec (poker10)
Jess (xjm)
.