Junglewise Threat Intelligence

CVE-2026-96379: Drupal Cookiecuttr module stored XSS in administration form

CVE-2026-96379 · Severity: info · Published 2026-09-23

Vendors: Drupal, Packagist:Https://Packages.Drupal.Org/8.

Executive brief

The Cookiecuttr module for Drupal, which manages cookie consent banners, contains a stored cross-site scripting (XSS) vulnerability in its administration interface. An attacker with the "administer cookiecuttr" permission can inject malicious scripts that are stored in the database and executed when the settings are viewed by administrators, potentially allowing account takeover or session hijacking of privileged users.

Technical details

The vulnerability exists in the Cookiecuttr administration form where user input is not properly sanitized before storage and rendering. An authenticated attacker with the "administer cookiecuttr" permission can inject JavaScript through form fields that is later executed in the browser of any administrator viewing those settings. This is a stored XSS requiring administrative role permissions and affects versions 2.0.0 through 2.0.2.

Affected products

  • Drupal Cookiecuttr 2.0.0 to 2.0.2

References