The vulnerability is an Improper Neutralization of Input During Web Page Generation flaw that allows attackers to store malicious scripts in the content managed by Drupal ABC. When a user accesses the stored content, the embedded script runs in that user’s browser, enabling the attacker to steal session data, deface the site, or perform other malicious actions. The weakness is categorized as CWE-79 (Cross‑Site Scripting).

Drupal ABC is affected in all releases from 0.0.0 through 1.25.0 as well as from 2.0.0 through 2.0.1. The vulnerability impacts any site or application that incorporates these Drupal ABC versions.

No EPSS score is available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is a stored XSS scenario where an attacker (or someone with permissions to submit content) submits crafted input that is subsequently rendered to users. While the exploitation requires the ability to create or modify stored content, the impact of successful exploitation is full client‑side control of the victim’s browser context for that site.