CVE-2026-2348

MEDIUM

Quick Edit - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-009

Title source: cna

Description

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Quick Edit allows Cross-Site Scripting (XSS).This issue affects Quick Edit: from 0.0.0 before 1.0.5, from 2.0.0 before 2.0.1.

References (1)

Core 1

Core References

https://www.drupal.org/sa-contrib-2026-009

Scores

CVSS v3 5.4

EPSS 0.0003

EPSS Percentile 10.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-79

Status published

Products (4)

Drupal/Quick Edit 0.0.0 - 1.0.5

Drupal/Quick Edit 2.0.0 - 2.0.1

wim-leers/quick_edit 2.0.0

wim-leers/quick_edit < 1.0.5

Published Mar 25, 2026

Tracked Since Mar 25, 2026