The Drupal Block Attributes module contains a stored cross‑site scripting flaw caused by improper neutralization of input during web page generation. User supplied content that is inserted into a block is not properly escaped, allowing an attacker to store malicious script on a website. When a visitor loads a page with the infected block, the stored code executes in their browser, potentially leading to credential theft, session hijacking, defacement, or other client‑side attacks. This weakness is classified as CWE‑79.

All Drupal sites that use the Block Attributes module with a version between 0.0.0 and 2.1.0 inclusive are affected. The vulnerability does not depend on the Drupal edition or database type; any installation that includes the vulnerable module and allows block editing on the site is at risk until the patch is applied.

The flaw requires an attacker to be able to create or modify block content via the Drupal administrative interface, meaning that any user with block‑editing privileges can exploit it. Once the payload is accepted, it is stored and automatically executed for every site visitor. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The potential for widespread script execution across all visitors gives the issue a high impact rating, especially in environments with less restricted block‑content permissions. Based on the description, the likely attack vector is through the Drupal admin UI where block content is entered.