The Drupal Email Verification / SMS Verification / OTP Verification module contains a reflected cross‑site scripting vulnerability that allows attackers to inject arbitrary JavaScript into the page. When a victim inputs a crafted value into a verification field, the unsanitized input is echoed back and executed in the victim’s browser. This can enable session hijacking, credential theft, data exfiltration, or malicious redirection, effectively compromising the confidentiality and integrity of the affected site as seen by end users.

The flaw affects all released versions of the module from 0.0.0 to 2.4.0. Any Drupal installation that has this module enabled and has not applied the official fix is vulnerable. The advisory does not list additional constraints or prerequisite conditions beyond the presence of the module.

The CVSS score is 5.4, and the EPSS score is less than 1%. The vulnerability is not listed in the CISA KEV catalog. It is a reflected XSS, which can be triggered by a simple malicious link or form submission and does not require authentication. Consequently the risk is moderate for sites where the verification functionality is publicly accessible, as attackers can run code in the victim’s browser, potentially leading to session hijacking or other client‑side attacks.