This CVE refers to a Cross‑Site Scripting flaw in the Drupal Country contributed module. The module fails to properly neutralize user‑supplied input before rendering it in HTML, allowing an attacker to inject malicious scripts that execute in the browser of any user viewing the affected page. An attacker who can supply crafted input could steal session cookies, deface content, or launch phishing attacks, compromising confidentiality and integrity for site visitors.

The vulnerability is present in Drupal Country module versions 0.0.0 through 2.1.3, and again in 2.2.0 and 2.2.1, all of which run on the Drupal content‑management platform.

The exploitation requires a web request to a page that includes unchecked user input from the Country module. While no EPSS score is available and the vulnerability is not listed in the KEV catalog, the CVSS metrics are omitted, implying that a moderate to high risk cannot be conclusively determined. However, because XSS is a well‑known attack vector capable of hijacking sessions, the risk remains significant. The attack vector is likely remote via the public web interface, and the prerequisite is that the module is enabled and its data fields are publicly viewable.