Vulnerability Directory | CVE-2026-0749 | Drupal 7

Overview

Drupal is an open-source content management system known for its flexibility, robust features, and strong community support. Organizations of all sizes use it to build and manage dynamic websites and web applications. There is a cross-site scripting vulnerability in the Form Builder contributed module.

It’s possible to inject malicious Javascript code into the JavaScript-based form building system provided by the Form Builder contributed module.

A cross-site scripting (XSS) vulnerability allows attackers to inject malicious scripts into webpages. It often occurs when a site fails to properly validate or sanitize user input, enabling the execution of unauthorized code within a victim's browser. It is included in the OWASP Top Ten list of vulnerabilities, specifically in the third category of Injection. A web site compromised in this way may experience:

Session hijacking
Data theft
Malware distribution
Defacement or phishing and
Privilege escalation.

This issue affects all versions of Drupal 7 Form Builder including and below 7.1.22; it is patched in Form Builder NES 7.1.23.

‍

Details

Module Info

Product: Drupal
Affected code: Form Builder module
Affected versions: >=7.1.0 <=7.1.22
Project page: https://www.drupal.org/project/form_builder
Fixed in: Form Builder NES 7.1.23

‍

Vulnerability Info

This medium-severity vulnerability is found in all versions of the Form Builder module up to and including 7.1.22.

‍

Addressing the Issue

Users of the affected component(s) should address this exploit in one of the following ways:

Strictly restrict user with access to the Form Builder graphical user interface
Sign up for post-EOL security support; HeroDevs customers get immediate access to a patched version of this module.

‍