The flaw stems from an improper neutralization of user‑supplied data before it is rendered in a web page. Based on the description, it is inferred that an attacker who supplies crafted input into a Webform field could have that input inserted into the resulting HTML without proper escaping. This scenario would allow the attacker to inject and execute arbitrary JavaScript in the browsers of users who view the page, potentially leading to credential theft, session hijacking, or defacement. The weakness is a typical Cross‑Site Scripting flaw identified as CWE‑79.

Drupal Webform modules from the initial 0.0.0 release through 6.2.12 and the two intermediate releases 6.3.0 to 6.3.1 contain the vulnerable code. Any installation that has one of those versions running and exposes the form to users is potentially exposed. The module lack of input sanitization applies to public forms and forms accessible over HTTP and HTTPS.

The EPSS score is below 1% and there is no KEV listing, and the CVSS score of 4.2 indicates a moderate severity for a client‑side flaw. Based on the description, the likely attack vector is that the flaw can be triggered simply by visiting a crafted URL or by submitting a malicious entry via the form, without requiring authentication or server‑side privileges. Given the ubiquity of the Webform component in Drupal sites, the risk to exposed systems is considered significant, and the attack path is straightforward for an attacker with knowledge of the form's structure.