Drupal Component blocks contains an improper neutralization of user input during web page generation, allowing an attacker to store malicious script payloads in block data that are later rendered unchanged in the browser. The flaw permits arbitrary client‑side code execution in the context of any user who views the affected block, potentially leading to credential theft, session hijacking, or defacement of the site. This Stored XSS is a classic input‑validation weakness identified as CWE‑79.

The vulnerability affects all releases of the Component blocks module from 0.0.0 through 1.2.7. It applies to any Drupal site that has installed one of these versions and is using the module to manage block content.

The CVSS score is 4.6, indicating a moderate impact. The EPSS score is < 1%, indicating a very low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Stored XSS is a known high‑impact flaw that can be exploited if an attacker can create or edit block content. The low EPSS suggests the likelihood is low but still possible especially with privileged users. Administrators should consider whether to patch promptly based on site exposure.