This vulnerability occurs when user input is inserted into output without proper neutralization during web page generation in the Drupal Calculation Fields module. The flaw enables attackers to inject malicious scripts that execute in a victim’s browser, potentially leading to session theft, credential compromise, or the execution of arbitrary code. The weakness is mapped to CWE‑79 and carries a CVSS base score of 6.1, reflecting a moderate severity.

The Drupal Calculation Fields module is vulnerable in all releases from the initial 0.0.0 version up to, but not including, 1.0.4. Administrators should verify the version of the module installed on all sites that use the Calculation Fields feature.

The EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog, indicating a low likelihood of widespread exploitation at present. Based on the description, it is inferred that an attacker could inject malicious script via the module’s input interface; the script would be rendered when any user views the affected content. No explicit authentication requirement is stated, so it is assumed that the vulnerability can be exercised without special privileges. Administrators should assess whether public‑facing sites run vulnerable versions and plan remediation accordingly.