The vulnerability in Drupal SafeDelete is an improper neutralization of input during page rendering that permits stored cross‑site scripting attacks. An attacker who can influence content managed by SafeDelete can inject arbitrary JavaScript that will execute in the browsers of any user who views the affected page, potentially allowing credential theft, session hijacking, or defacement. This flaw is categorized as CWE-79 and can compromise the confidentiality, integrity, and availability of affected applications.

The SafeDelete contrib module for Drupal is affected in all releases from version 0.0.0 up to and including 1.0.88. The only vendor listed is the Drupal project for SafeDelete.

Exploit requires the attacker to submit or edit content via SafeDelete, which typically requires authenticated access with content editing privileges. Once the stored payload is present, any user who opens the affected page will receive the malicious script. The CVSS score is 4.6 and the EPSS indicates a very low likelihood (less than 1%), and the vulnerability is not listed in the CISA KEV catalog, but the stored XSS nature makes it a moderate risk issue if the module is deployed.