Drupal core contains a stored cross‑site scripting vulnerability (CWE‑79) that allows an attacker to embed malicious JavaScript into content that is persisted and served to users. When a web page containing the compromised content is rendered, the browser executes the injected script. The vulnerability arises from a failure to neutralize user input during web page generation.

All Drupal core releases up to and including version 11.4.4 are affected. The advisory lists affected ranges from version 0.0.0 through 10.6.13, 11.3.0–11.3.14, 11.4.0–11.4.4, as well as the entire 11.0.*, 11.1.*, and 11.2.* series. Any Drupal core installation prior to 10.6.14 or 11.3.15 that has not applied the patch is vulnerable.

The EPSS score is currently unavailable and the vulnerability is not listed in CISA’s KEV catalog, indicating no known widespread exploitation at this time. The attack requires the ability to submit content that is stored and later rendered to other users. It is inferred that an attacker can inject malicious payloads via comment forms, user profile fields, or custom blocks that allow raw HTML, and that the payload will execute on the browsers of visitors who view the affected content. This does not require elevated server privileges but depends on the user's input permissions.