The Advanced Content Feedback module in Drupal permits an attacker to store malicious script payloads in normal content that is later rendered to users. This stored XSS flaw originates from the module’s failure to properly neutralize user‑supplied input before generating web pages, allowing injected JavaScript to execute when the affected content is viewed. If successful, a malicious user could steal session cookies, perform phishing, or hijack user accounts, thereby compromising confidentiality, integrity, and potentially availability of the Drupal site.

Drupal sites running the Advanced Content Feedback module, versions 0.0.0 through 2.8.0, are affected. This includes any installation that has enabled the module in that version range. No other Drupal modules are mentioned as vulnerable.

The vulnerability is a stored XSS, which is generally considered high risk when a malicious payload can be persisted and later executed. The CVSS score is 6.1, indicating moderate risk. The EPSS score is < 1%, suggesting a very low exploitation probability, though the vulnerability remains high risk due to its stored nature. The attack is likely to occur through normal web interactions—an attacker can simply submit content or feedback containing the malicious script via the module’s interface, which will then be served to any user who views the content. Because the flaw is stored, the impact extends to all users accessing the compromised content. The vulnerability is listed as not in KEV and no official patch or workaround is included in the supplied data, indicating that administrators should treat the issue with priority.