Drupal Sector Distribution contains an improper neutralization of input flaw that allows attackers to store malicious scripts in content managed by the module. When a victim views the stored content, the browser will execute the injected script, enabling piracy of credentials, session hijacking, defacement, or other client‑side attacks. The impact is primarily the confidentiality and integrity of user interactions and can affect any user who views the vulnerable content.

The vulnerability affects the Sector Distribution module for Drupal, versions from 0.0.0 through 10.3.3 and from 10.4.0 through 10.4.2. Users running any of those releases are at risk.

The exploit requires an attacker to place malicious code in the module’s data storage; it is not clear from the description whether authentication is required, but based on the functionality of content editing interfaces it is inferred that contributors with write access could perform the injection. No special privileges beyond the ability to modify content are necessary. The EPSS score is not available and the vulnerability is not listed in CISA KEV, however the widespread availability of the affected module and the high potential impact suggest a significant likelihood of exploitation. Defenders should treat this as a high‑priority concern until corrected.