The Gin Admin Theme contains an improper neutralization of input during page generation that permits attackers to inject arbitrary script code into rendered web pages. When rendered, the injected code can execute in the victim’s browser, potentially capturing session cookies, staging phishing attacks, and compromising site data. The weakness falls under CWE‑79, a classic reflected XSS flaw.

The vulnerability is present in all releases of the Drupal Gin Admin Theme from 0.0.0 through 4.1.4, and from 5.0.0 through 5.0.16. Users deploying any of these versions in a Drupal environment are affected.

No CVSS score is publicly disclosed, and the EPSS information is not available, so the precise exploitation probability is unknown, but the flaw permits remote code injection via web requests that include attacker‑controlled payloads. The gradient of impact is contingent on user permissions; authenticated users could submit data that ends up rendered to other users, while unauthenticated users may be limited to data that they can input on publicly reachable pages. The flaw is not listed in CISA’s KEV catalog, reducing the urgency but still requiring remediation because the potential for abuse is significant.