CVE-2026-3528 - Calculation Fields - Moderately critical - Cross-site Scripting

Back Back to CVE browser

MEDIUM

Calculation Fields - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-023

Published Mar 26, 2026

6.1

MEDIUM

CVSS 3.1

EPSS 0.25%

Description

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Calculation Fields allows Cross-Site Scripting (XSS).This issue affects Calculation Fields: from 0.0.0 before 1.0.4.

Affected products

Vendor Drupal Product Calculation Fields Default
unaffected
- Version
  0.0.0
  Status
  affected
  Constraints
  <1.0.4

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Drupal

Calculation Fields

unaffected

Version	Status	Constraints
0.0.0	affected	<1.0.4

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-16381
Advisory
https://www.drupal.org/sa-contrib-2026-023
Vendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-16381		Advisory
https://www.drupal.org/sa-contrib-2026-023		Vendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner drupal

Published Mar 26, 2026

Updated Mar 27, 2026

Reserved Mar 4, 2026

Link CVE-2026-3528

CISA Vulnrichment

Updated Mar 27, 2026

NVD

Status Analyzed

Modified Jun 17, 2026

Link CVE-2026-3528

Red Hat

Severity n/a

Public date n/a

Links CVE-2026-3528

ENISA EUVD

Assigner drupal

Published Mar 26, 2026

Updated Mar 27, 2026

Exploited since n/a

Link EUVD-2026-16381

EUVD-2026-16381