Project:
Project machine name:
paragraphs_entity_embedDate:
2026-November-11
Vulnerability:
Cross-site scripting
Affected versions:
<4.0.1
CVE IDs:
CVE-2026-126734
Description:
This module enables you to provide a way to embed parapraphs in any rich-text field using the WYSIWYG editor.
The module doesn't sufficiently filter for malicious text in the autocomplete search filter, leading to a cross-site scripting vulnerability.
This vulnerability is mitigated by the fact that an attacker must have permission to edit the label of the paragraph entity.
Solution:
Install the latest version:
- Upgrade to Paragraphs entity embed 4.0.1.
Reported By:
Coordinated By:
- Swan Kalata (akalata) of the Drupal Security Team
- Bram Driesen (bramdriesen) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
