← Vulnerability Intelligence

CVE-2026-118575

Not yet rated

Not yet rated — under the NVD policy in effect since April 2026, most CVEs are no longer analyzed immediately. The EPSS score (if available) is still shown.

Description

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Signature pad widget allows Stored XSS. This issue affects Signature pad widget versions: from 0.0.0 to 1.15.0.

Metrics

EPSS — exploit probability
0% (percentile: 5) as of 1 November 2026
CWE
CWE-79

References