An improper neutralization of input during web page generation, identified as a Cross‑Site Scripting (XSS) flaw, allows attackers to inject arbitrary script into pages rendered by the Drupal Form Builder module. The consequence is that a malicious script can execute in the browser context of any user who views the affected form, potentially leading to session hijacking, data theft, or defacement. The weakness is classed under CWE‑79 and carries a CVSS score of 4.8.

The vulnerability affects the Drupal Form Builder module versions 7.X‑1.0 through 7.X‑1.22. Administrators should verify whether their sites run any of these versions and apply updates accordingly.

With a moderate CVSS score and an EPSS of less than 1%, exploitation is possible but not highly likely to occur in the wild. The flaw is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation typically requires an attacker to supply crafted input via the form builder interface, which is then reflected without proper escaping. There are no reported public exploits, but the low EPSS does not eliminate risk, especially in sites with public-facing forms.