The vulnerability lies in the Drupal Swiper formatter plugin, where user-supplied input is stored and rendered without adequate sanitization. An attacker can inject malicious JavaScript that executes in the browsers of anyone who views the affected Swiper content. Stored XSS can be used to steal session cookies, deface pages, or deliver arbitrary client‑side payloads.

The flaw affects Drupal Swiper formatter versions from 0.0.0 through 2.1.2 and from 3.0.1 through 3.1.0. All installations of the Swiper formatter within these version ranges are vulnerable if the formatter is enabled and used to display content entered by users.

No CVSS score is reported and the EPSS is listed as not available, making the precise exploitation likelihood uncertain. The vulnerability is not yet cataloged in the CISA KEV list. Attackers can exploit the issue by creating a Swiper configuration that contains malicious script via the content editing interface; the code will be stored and executed whenever the content is viewed. The impact can be severe for exposed sites, enabling data theft and arbitrary JavaScript execution in the user's browser.