Is CVE-2026-126734 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126734 being exploited in the wild.

How severe is CVE-2026-126734?

Informational severity, published 11 November 2026.

Which products and versions are affected?

Drupal Paragraphs Entity Embed <4.0.1; Packagist:Https://Packages.Drupal.Org/8 Drupal/Paragraphs Entity Embed ECOSYSTEM:introduced=0,fixed=4.0.1.

Is there a fix for CVE-2026-126734?

Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Paragraphs Entity Embed: upgrade to 4.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-126734 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-126734?

Check whether you run Drupal Paragraphs Entity Embed or Packagist:Https://Packages.Drupal.Org/8 Drupal/Paragraphs Entity Embed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126734: Paragraphs entity embed cross-site scripting in autocomplete filter

Q: Is there a fix for CVE-2026-126734?

Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Paragraphs Entity Embed: upgrade to 4.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-126734 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-126734?

Check whether you run Drupal Paragraphs Entity Embed or Packagist:Https://Packages.Drupal.Org/8 Drupal/Paragraphs Entity Embed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126734 · Severity: info · Published 2026-11-11

The Paragraphs entity embed module for Drupal enables embedding rich content in text fields through a WYSIWYG editor. The module fails to properly filter malicious input in its autocomplete search feature, allowing a stored cross-site scripting (XSS) attack. An attacker must have permission to edit paragraph entity labels to exploit this vulnerability.

Vendors: Drupal, Packagist:Https://Packages.Drupal.Org/8.

Quick answers

Is CVE-2026-126734 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126734 being exploited in the wild.
How severe is CVE-2026-126734?: Informational severity, published 11 November 2026.
Which products and versions are affected?: Drupal Paragraphs Entity Embed <4.0.1; Packagist:Https://Packages.Drupal.Org/8 Drupal/Paragraphs Entity Embed ECOSYSTEM:introduced=0,fixed=4.0.1.
Is there a fix for CVE-2026-126734?: Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Paragraphs Entity Embed: upgrade to 4.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126734 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-126734?: Check whether you run Drupal Paragraphs Entity Embed or Packagist:Https://Packages.Drupal.Org/8 Drupal/Paragraphs Entity Embed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Packagist:Https://Packages.Drupal.Org/8 Drupal/Paragraphs Entity Embed: upgrade to 4.0.1 or later

Technical details

The autocomplete search filter in the paragraphs_entity_embed module does not sufficiently sanitize user-supplied text, allowing injection of malicious scripts into paragraph labels. An attacker with permission to edit paragraph entity labels can inject XSS payloads that execute when other users interact with the autocomplete feature. The vulnerability requires authenticated access to modify paragraph labels, limiting its exposure.

Affected products

Drupal paragraphs_entity_embed <4.0.1

Identifiers

CVE-2026-126734
DRUPAL-CONTRIB-2026-325

Timeline

2026-11-11: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.