Drupal Colorbox Inline contains an improperly neutralized input during web page generation flaw that allows attackers to inject arbitrary HTML or JavaScript when the module renders content. The vulnerability can lead to execution of JavaScript in the context of the victim’s browser, enabling session hijacking, credential theft, or malicious site defacement. The weakness is a classic XSS defect, identified as CWE-79, and the impact is limited to the scope of the Drupal installation that loads the Colorbox Inline plugin.

The flaw affects all installations of the Colorbox Inline module with version numbers from 0.0.0 up to, but not including, 2.1.1. Any Drupal site that has not upgraded past 2.1.0 remains vulnerable.

Based on the description, the likely attack vector is a reflected or stored XSS that can be triggered by loading a crafted page or content entry containing malicious input. The CVSS score of 5.4 classifies the vulnerability as moderately critical, and the EPSS score of less than 1% indicates a low probability of exploitation. The flaw can be exploited by an attacker who can influence the content that Colorbox Inline displays, for example by creating a link or posting a comment with injected payloads. Hosting the Drupal site without restricting unauthenticated content injection or employing adequate input filtering increases the risk of exploitation.