The module contains a cross‑site scripting flaw due to improper input neutralization during page rendering. An attacker could inject malicious scripts that execute in the browsers of users viewing the affected pages. This could lead to client‑side compromise, such as session hijacking or data theft, but the scope is limited to the user’s browser. The weakness aligns with CWE‑79.

Drupal sites that have the Responsive Favicons module installed in any release earlier than 2.0.2 are impacted. This includes initial 0.0.0 through 2.0.1. Any site that is still using those versions is vulnerable.

The CVSS base score of 4.8 indicates moderate severity. The EPSS score is below 1%, and the flaw is not listed in the CISA KEV catalog, suggesting that active exploitation is currently unlikely. The likely attack vector would require a user to view a page rendered by the module or submit data that is processed by it. If the module is publicly accessible, remote exploitation is plausible, but for sites that restrict access to authenticated users, the risk decreases. The attacker would need to supply crafted input that reaches the rendering path. No exploitation prerequisites beyond typical site access are noted in the description.