Drupal Zero Point contains an improper neutralization of input during web page generation, allowing a stored cross‑site scripting attack. An attacker can inject malicious code that will be executed in the browsers of other site visitors, potentially leading to credential theft, session hijacking, or defacement. The weakness is a classic CWE‑79 type flaw where user supplied data is not properly encoded before being presented back to users.

Drupal Zero Point is impacted. The vulnerability exists in versions from 0.0.0 through 1.30.0 and also in 2.0.0 through 2.0.1. All other versions are not known to be affected.

No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, but cross‑site scripting is a high‑severity issue when feasible to exploit. The likely attack vector is via any user‑visible content entry within the module where input is stored and later rendered. Because the flaw is in containment of stored data, a successful exploitation requires only the ability to input data into the system, which may be widely available to authenticated or unauthenticated users depending on configuration. The lack of a publicly released patch at this time, combined with the high potential impact, makes the risk moderate to high for organizations running the affected versions.