Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-118560 (GCVE-0-2026-118560)

Vulnerability from nvd – Published: 2026-10-30 03:09 – Updated: 2026-10-30 03:09

Title

Commerce Stripe - Moderately critical - Cross site scripting - SA-CONTRIB-2026-265

Summary

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Commerce Stripe allows Cross-Site Scripting (XSS). This issue affects Commerce Stripe versions: from 2.0.0 to 2.2.3.

Severity

No CVSS data available.

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")

Assigner

drupal CNA under the mitre root

CNA scorecard D 53/100 over 279 records in the last 180 days details

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-265

Impacted products

1 product

Vendor	Product	Version
Drupal	Commerce Stripe	Affected: 2.0.0 , < 2.2.3 (semver)

Date Public

2026-10-28 16:57

Credits

Brian Willows (hsjbrianwillows) Ryan Szrama (rszrama) Tom Ashe (tomtech) Jonathan Sacksick (jsacksick) Swan Kalata (akalata) Greg Knaddison (greggles) Juraj Nemec (poker10) Jess (xjm)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/commerce_stripe",
          "product": "Commerce Stripe",
          "repo": "https://git.drupalcode.org/project/commerce_stripe",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "2.2.3",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Brian Willows (hsjbrianwillows)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Ryan Szrama (rszrama)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Tom Ashe (tomtech)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jonathan Sacksick (jsacksick)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Swan Kalata (akalata)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jess  (xjm)"
        }
      ],
      "datePublic": "2026-10-28T16:57:01.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Commerce Stripe allows Cross-Site Scripting (XSS). This issue affects Commerce Stripe versions: from 2.0.0 to 2.2.3."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-63",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-63 Cross-Site Scripting (XSS)"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\")",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T03:09:01.410Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-265"
        }
      ],
      "title": "Commerce Stripe - Moderately critical - Cross site scripting - SA-CONTRIB-2026-265"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-118560",
    "datePublished": "2026-10-30T03:09:01.410Z",
    "dateReserved": "2026-10-28T15:50:46.719Z",
    "dateUpdated": "2026-10-30T03:09:01.410Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-118559 (GCVE-0-2026-118559)

Vulnerability from nvd – Published: 2026-10-30 03:09 – Updated: 2026-10-30 03:09

Title

Commerce Stripe - Moderately critical - Improper verification of cryptographic signature - SA-CONTRIB-2026-264

Summary

Improper Verification of Cryptographic Signature vulnerability in Drupal Commerce Stripe allows Signature Spoof. This issue affects Commerce Stripe versions: from 0.0.0 to 1.4, from 2.0.0 to 2.2.3.

Severity

No CVSS data available.

CWE

CWE-347 - Improper Verification of Cryptographic Signature

Assigner

drupal CNA under the mitre root

CNA scorecard D 53/100 over 279 records in the last 180 days details

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-264

Impacted products

1 product

Vendor	Product	Version
Drupal	Commerce Stripe	Affected: 0.0.0 , < 1.4 (semver) Affected: 2.0.0 , < 2.2.3 (semver)

Date Public

2026-10-28 16:56

Credits

Brian Willows (hsjbrianwillows) Ryan Szrama (rszrama) Tom Ashe (tomtech) Swan Kalata (akalata) Greg Knaddison (greggles) Juraj Nemec (poker10) Jess (xjm)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/commerce_stripe",
          "product": "Commerce Stripe",
          "repo": "https://git.drupalcode.org/project/commerce_stripe",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "1.4",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.2.3",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Brian Willows (hsjbrianwillows)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Ryan Szrama (rszrama)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Tom Ashe (tomtech)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Swan Kalata (akalata)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jess  (xjm)"
        }
      ],
      "datePublic": "2026-10-28T16:56:52.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper Verification of Cryptographic Signature vulnerability in Drupal Commerce Stripe allows Signature Spoof. This issue affects Commerce Stripe versions: from 0.0.0 to 1.4, from 2.0.0 to 2.2.3."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-473",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-473 Signature Spoof"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-347",
              "description": "CWE-347 Improper Verification of Cryptographic Signature",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T03:09:02.462Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-264"
        }
      ],
      "title": "Commerce Stripe - Moderately critical - Improper verification of cryptographic signature - SA-CONTRIB-2026-264"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-118559",
    "datePublished": "2026-10-30T03:09:02.462Z",
    "dateReserved": "2026-10-28T15:50:46.719Z",
    "dateUpdated": "2026-10-30T03:09:02.462Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-118558 (GCVE-0-2026-118558)

Vulnerability from nvd – Published: 2026-10-30 03:09 – Updated: 2026-10-30 03:09

Title

Commerce Stripe - Critical - Cross-site request forgery - SA-CONTRIB-2026-263

Summary

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Stripe allows Cross Site Request Forgery. This issue affects Commerce Stripe versions: from 2.0.0 to 2.2.3.

Severity

No CVSS data available.

CWE

CWE-352 - Cross-Site Request Forgery (CSRF)

Assigner

drupal CNA under the mitre root

CNA scorecard D 53/100 over 279 records in the last 180 days details

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-263

Impacted products

1 product

Vendor	Product	Version
Drupal	Commerce Stripe	Affected: 2.0.0 , < 2.2.3 (semver)

Date Public

2026-10-28 16:56

Credits

Brian Willows (hsjbrianwillows) Ryan Szrama (rszrama) Tom Ashe (tomtech) Jonathan Sacksick (jsacksick) Swan Kalata (akalata) Greg Knaddison (greggles) Juraj Nemec (poker10) Jess (xjm)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/commerce_stripe",
          "product": "Commerce Stripe",
          "repo": "https://git.drupalcode.org/project/commerce_stripe",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "2.2.3",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Brian Willows (hsjbrianwillows)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Ryan Szrama (rszrama)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Tom Ashe (tomtech)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jonathan Sacksick (jsacksick)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Swan Kalata (akalata)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jess  (xjm)"
        }
      ],
      "datePublic": "2026-10-28T16:56:43.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Stripe allows Cross Site Request Forgery. This issue affects Commerce Stripe versions: from 2.0.0 to 2.2.3."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-62",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-62 Cross Site Request Forgery"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T03:09:03.476Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-263"
        }
      ],
      "title": "Commerce Stripe - Critical - Cross-site request forgery - SA-CONTRIB-2026-263"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-118558",
    "datePublished": "2026-10-30T03:09:03.476Z",
    "dateReserved": "2026-10-28T15:50:46.719Z",
    "dateUpdated": "2026-10-30T03:09:03.476Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-118558 (GCVE-0-2026-118558)

Vulnerability from cvelistv5 – Published: 2026-10-30 03:09 – Updated: 2026-10-30 03:09

Title

Commerce Stripe - Critical - Cross-site request forgery - SA-CONTRIB-2026-263

Summary

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Stripe allows Cross Site Request Forgery. This issue affects Commerce Stripe versions: from 2.0.0 to 2.2.3.

Severity

No CVSS data available.

CWE

CWE-352 - Cross-Site Request Forgery (CSRF)

Assigner

drupal CNA under the mitre root

CNA scorecard D 53/100 over 279 records in the last 180 days details

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-263

Impacted products

1 product

Vendor	Product	Version
Drupal	Commerce Stripe	Affected: 2.0.0 , < 2.2.3 (semver)

Date Public

2026-10-28 16:56

Credits

Brian Willows (hsjbrianwillows) Ryan Szrama (rszrama) Tom Ashe (tomtech) Jonathan Sacksick (jsacksick) Swan Kalata (akalata) Greg Knaddison (greggles) Juraj Nemec (poker10) Jess (xjm)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/commerce_stripe",
          "product": "Commerce Stripe",
          "repo": "https://git.drupalcode.org/project/commerce_stripe",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "2.2.3",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Brian Willows (hsjbrianwillows)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Ryan Szrama (rszrama)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Tom Ashe (tomtech)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jonathan Sacksick (jsacksick)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Swan Kalata (akalata)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jess  (xjm)"
        }
      ],
      "datePublic": "2026-10-28T16:56:43.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Stripe allows Cross Site Request Forgery. This issue affects Commerce Stripe versions: from 2.0.0 to 2.2.3."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-62",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-62 Cross Site Request Forgery"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T03:09:03.476Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-263"
        }
      ],
      "title": "Commerce Stripe - Critical - Cross-site request forgery - SA-CONTRIB-2026-263"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-118558",
    "datePublished": "2026-10-30T03:09:03.476Z",
    "dateReserved": "2026-10-28T15:50:46.719Z",
    "dateUpdated": "2026-10-30T03:09:03.476Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-118559 (GCVE-0-2026-118559)

Vulnerability from cvelistv5 – Published: 2026-10-30 03:09 – Updated: 2026-10-30 03:09

Title

Commerce Stripe - Moderately critical - Improper verification of cryptographic signature - SA-CONTRIB-2026-264

Summary

Improper Verification of Cryptographic Signature vulnerability in Drupal Commerce Stripe allows Signature Spoof. This issue affects Commerce Stripe versions: from 0.0.0 to 1.4, from 2.0.0 to 2.2.3.

Severity

No CVSS data available.

CWE

CWE-347 - Improper Verification of Cryptographic Signature

Assigner

drupal CNA under the mitre root

CNA scorecard D 53/100 over 279 records in the last 180 days details

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-264

Impacted products

1 product

Vendor	Product	Version
Drupal	Commerce Stripe	Affected: 0.0.0 , < 1.4 (semver) Affected: 2.0.0 , < 2.2.3 (semver)

Date Public

2026-10-28 16:56

Credits

Brian Willows (hsjbrianwillows) Ryan Szrama (rszrama) Tom Ashe (tomtech) Swan Kalata (akalata) Greg Knaddison (greggles) Juraj Nemec (poker10) Jess (xjm)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/commerce_stripe",
          "product": "Commerce Stripe",
          "repo": "https://git.drupalcode.org/project/commerce_stripe",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "1.4",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.2.3",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Brian Willows (hsjbrianwillows)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Ryan Szrama (rszrama)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Tom Ashe (tomtech)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Swan Kalata (akalata)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jess  (xjm)"
        }
      ],
      "datePublic": "2026-10-28T16:56:52.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper Verification of Cryptographic Signature vulnerability in Drupal Commerce Stripe allows Signature Spoof. This issue affects Commerce Stripe versions: from 0.0.0 to 1.4, from 2.0.0 to 2.2.3."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-473",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-473 Signature Spoof"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-347",
              "description": "CWE-347 Improper Verification of Cryptographic Signature",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T03:09:02.462Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-264"
        }
      ],
      "title": "Commerce Stripe - Moderately critical - Improper verification of cryptographic signature - SA-CONTRIB-2026-264"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-118559",
    "datePublished": "2026-10-30T03:09:02.462Z",
    "dateReserved": "2026-10-28T15:50:46.719Z",
    "dateUpdated": "2026-10-30T03:09:02.462Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-118560 (GCVE-0-2026-118560)

Vulnerability from cvelistv5 – Published: 2026-10-30 03:09 – Updated: 2026-10-30 03:09

Title

Commerce Stripe - Moderately critical - Cross site scripting - SA-CONTRIB-2026-265

Summary

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Commerce Stripe allows Cross-Site Scripting (XSS). This issue affects Commerce Stripe versions: from 2.0.0 to 2.2.3.

Severity

No CVSS data available.

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")

Assigner

drupal CNA under the mitre root

CNA scorecard D 53/100 over 279 records in the last 180 days details

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-265

Impacted products

1 product

Vendor	Product	Version
Drupal	Commerce Stripe	Affected: 2.0.0 , < 2.2.3 (semver)

Date Public

2026-10-28 16:57

Credits

Brian Willows (hsjbrianwillows) Ryan Szrama (rszrama) Tom Ashe (tomtech) Jonathan Sacksick (jsacksick) Swan Kalata (akalata) Greg Knaddison (greggles) Juraj Nemec (poker10) Jess (xjm)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/commerce_stripe",
          "product": "Commerce Stripe",
          "repo": "https://git.drupalcode.org/project/commerce_stripe",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "2.2.3",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Brian Willows (hsjbrianwillows)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Ryan Szrama (rszrama)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Tom Ashe (tomtech)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jonathan Sacksick (jsacksick)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Swan Kalata (akalata)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jess  (xjm)"
        }
      ],
      "datePublic": "2026-10-28T16:57:01.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Commerce Stripe allows Cross-Site Scripting (XSS). This issue affects Commerce Stripe versions: from 2.0.0 to 2.2.3."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-63",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-63 Cross-Site Scripting (XSS)"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\")",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T03:09:01.410Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-265"
        }
      ],
      "title": "Commerce Stripe - Moderately critical - Cross site scripting - SA-CONTRIB-2026-265"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-118560",
    "datePublished": "2026-10-30T03:09:01.410Z",
    "dateReserved": "2026-10-28T15:50:46.719Z",
    "dateUpdated": "2026-10-30T03:09:01.410Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

6 vulnerabilities found for Commerce Stripe by Drupal

CVE-2026-118560 (GCVE-0-2026-118560)

CVE-2026-118559 (GCVE-0-2026-118559)

CVE-2026-118558 (GCVE-0-2026-118558)

CVE-2026-118558 (GCVE-0-2026-118558)

CVE-2026-118559 (GCVE-0-2026-118559)

CVE-2026-118560 (GCVE-0-2026-118560)