The CVE describes an XSS vulnerability due to improper neutralization of input during web page generation. Attackers may inject malicious JavaScript into form data that is reflected when the page is rendered, potentially enabling defacement, credential theft, or session hijacking for users who view the compromised form. The weakness is a client‑side input validation deficiency.

The affected product is the Drupal Webform module for Drupal content management systems. Vulnerabilities exist in all released versions from 0.0.0 up to and including 6.2.12, as well as the two patch releases 6.3.0 through 6.3.1. Any site running the Webform module within these version ranges is potentially impacted.

The vulnerability can be triggered by a user submitting arbitrary input into a Webform field that is later rendered in the same page. Because the flaw allows arbitrary script execution in the context of the victim’s browser, the confidentiality, integrity, and availability of users’ sessions can be compromised. The EPSS score indicates a low probability of exploitation (<1%) and the vulnerability is not listed in the CISA KEV catalog, so the chance of exploitation remains low. The CVSS score is 3.5, indicating low severity. Mitigating actions should be taken promptly.