The vulnerability is an improper neutralization of user input during web page generation, enabling an attacker to inject malicious scripts that will be executed when other users view the page. The scripts run in the victim’s browser context. Based on typical XSS behavior, such execution could potentially allow an attacker to manipulate the user session or exfiltrate data, though the CVE description does not explicitly state these outcomes.

The vulnerability affects the UI Patterns module in Drupal, specifically versions ranging from 2.0.0 through 2.0.17. All installations of this module within that version span are susceptible to stored cross‑site scripting if not updated.

The EPSS score is < 1%, indicating a very low, but non‑zero, probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, so there is no current exploitation data. Based on typical effects of stored XSS, the flaw could affect confidentiality and integrity of users if the module is used by general users through the content editing UI, where an authorized user can inject malicious code that will persist across sessions. Given the low exploitation probability but the moderate severity indicated by the CVSS score of 5.4, the overall risk is considered moderate to high, depending on the deployment context and user behavior.