The Drupal module Mother May I contains an input handling flaw that, as a CWE‑79 vulnerability, typically permits arbitrary JavaScript injection. The CVE description does not detail the precise mechanism, so it is inferred that the flaw allows unsanitized user input to be rendered in the browser, creating a potential cross‑site scripting vector. If an attacker successfully injects malicious code, they could force victims’ browsers to execute that code in the context of the site, enabling session hijacking, data theft, or defacement.

All releases of the Drupal Mother May I module, as indicated by the wildcard '*.*' in the CVE entry, are vulnerable. The flaw exists regardless of the Drupal core version, meaning every site that installs this module – in development or production – is potentially exposed.

The vulnerability carries a CVSS base score of 9.8, reflecting its severe impact on confidentiality, integrity, and availability. The EPSS score of less than 1% suggests no widespread exploitation to date, and the issue is not listed in the CISA KEV catalog. Attackers likely target publicly accessible inputs processed by the module; because authentication is not required, any user reaching the affected page could trigger the flaw. The path to exploitation derives from submission of unsanitized data that is later rendered in the browser, allowing injection of malicious scripts.