Cross-site Scripting Vulnerability in Drupal Feed Block
CVE-2026-87939

Currently unrated

Key Information:

Vendor

Drupal
Status
Feed Block
Vendor
CVE Published:
22 October 2026

What is CVE-2026-87939?

The Feed Block for Drupal is vulnerable to a Cross-site Scripting (XSS) attack due to improper handling of user input when generating web pages. This flaw enables attackers to inject malicious scripts into content that can be stored and executed later, compromising user sessions and exposing sensitive data. Users of Feed Block versions from 0.0.0 to 2.0.2 and from 3.0.0 to 3.0.2 are particularly at risk. It is essential for site administrators to promptly apply patches and updates to mitigate this vulnerability.

Affected Version(s)

Feed Block 0.0.0 < 2.0.2

Feed Block 3.0.0 < 3.0.2

References

https://www.drupal.org/sa-contrib-2026-137

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Marcus Johansson (marcus_johansson)
Greg Knaddison (greggles)
Mark Fullmer (mark_fullmer)
mmarler
Bram Driesen (bramdriesen)
Greg Knaddison (greggles)
Juraj Nemec (poker10)
Jess (xjm)
Swan Kalata (akalata)
.