CVE-2026-84924

MediumCVSS 5.4

Published: 22/10/2026(UTC)Updated: 22/10/2026(UTC)Translated: 22/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Summary

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Reflected XSS. This issue affects Email Verification / SMS Verification / OTP Verification versions from 0.0.0 to 2.4.0.

Risk Assessment

An attacker can trick a user into clicking a crafted link, causing a malicious script to execute in their browser and potentially leading to session theft.

Recommendation

Update the module to a version later than 2.4.0. Consider deploying a Content-Security-Policy header to mitigate XSS impact.

Other vulnerabilities in Drupal Email Verification / SMS Verification / OTP Verification

CVE-2026-84923Medium
The Email Verification / SMS Verification / OTP Verification module for Drupal contains an Authentication Bypass Using an Alternate Path or Channel vulnerability that allows authentication bypass. This issue affects versions from 0.0.0 to 2.4.0.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS