Improper neutralization of input during web page generation in Drupal core allows attackers to inject malicious scripts that execute in the context of the victim’s browser. Stored or reflected XSS could enable session hijacking, credential theft, or phishing attacks against site users. The affected code in Drupal core lacks appropriate sanitization on user‑supplied data rendered in page output.

This vulnerability is present in Drupal core from versions 10.3.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, and from 12.0.0‑alpha1 to 12.0.0‑beta2. Any website running one of these core releases without a later patch is susceptible. The issue affects the Drupal:Drupal core product line.

The CVSS score is not provided, and EPSS is unavailable; the vulnerability is not listed in CISA KEV. Despite this, the potential for significant impact remains, as XSS can be triggered through a wide array of user input paths such as comments, form fields, or URL parameters. An attacker can exploit the flaw without authentication, or with minimal privileges, by crafting a malicious payload that is rendered on a page. The combined risk is moderate to high for unpatched installations, warranting immediate remediation.