The vulnerability is an Improper Neutralization of Input During Web Page Generation (Cross‑Site Scripting) flaw in Drupal Webform. It allows an attacker to inject arbitrary JavaScript into web pages rendered by Webform, which can lead to session hijacking, defacement, or execution of malicious code in the context of a victim’s browser. The flaw arises from insufficient escaping of user‑supplied form input before outputting it to the page.

Drupal Webform is affected. The issue covers all releases from 0.0.0 up to and including 6.2.12, and also from 6.3.0 up to 6.3.1. Any site that has installed the module in any of these versions is vulnerable.

The CVSS score of 4.6 indicates a moderate severity. The EPSS score of <1% shows a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is through submission of crafted form data to a Webform entry point; an attacker does not require privileged access and can exploit the flaw by simply visiting a page containing a vulnerable form. Because the flaw is widely applicable to many Drupal sites, the risk is moderate for sites that use the affected Webform module and have exposed entry points to unauthenticated users. Prompt remediation is recommended due to the widespread impact shown by the cross‑site scripting potential.