Drupal Feed Block allows stored XSS because input is not properly neutralized before rendering. An attacker can embed malicious scripts into feed items that will execute in the browsers of any visitor who views those feeds. This can lead to credential theft, session hijacking, or content defacement by running arbitrary code in the victim’s context.

The vulnerability affects Drupal Feed Block versions ranging from 0.0.0 to 2.0.2 and from 3.0.0 to 3.0.2. No specific vendor build or platform is listed beyond the module itself. Users of those versions should identify whether they are running a vulnerable release.

The EPSS score is < 1% and the CVSS is 4.2, indicating medium risk. The issue is not listed in the KEV catalog, so publicly known exploitation data is limited. The likely attack vector is via an input field that accepts feed content; the attacker must have the ability to create or edit feed entries. If such permissions exist, exploitation is straightforward and can impact all users who view the affected feeds.