A stored cross‑site scripting flaw exists in the Drupal Data field module. User supplied content is rendered without proper neutralization of HTML, allowing an attacker to embed malicious JavaScript that is subsequently executed whenever the affected page is viewed. This type of client‑side code execution can lead to session hijacking, credential theft, or defacement of the site.

Drupal Data field users of the module are affected. All versions from 0.0.0 up to and including 2.0.14 are vulnerable. No other products are listed.

The vulnerability is severe because it allows arbitrary script execution in the context of authenticated or unauthenticated page views. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but stored XSS remains a high‑risk attack vector. Exploitation requires an attacker to submit malicious content through a data field form, which applies to any user with write access to the module. Once stored, the payload is delivered to all visitors, making the threat surface wide.