The vulnerability is a privilege defined with unsafe actions flaw in the Drupal Webform module that permits persistent cross‑site scripting. Malicious content entered into a form that is later rendered to all visitors can enable session hijacking, defacement, or the exfiltration of sensitive data, compromising the integrity and confidentiality of the site. The underlying weakness stems from improper input handling during privilege configuration, making the site vulnerable to script injection.

Drupal Webform is impacted in all released versions from 0.0.0 through 6.2.12 inclusive and again in 6.3.0 to 6.3.1. The fixed code resides in later releases of the module, starting with version 6.3.2.

Exploitability depends on a user’s ability to create or edit forms that contain unsafe privileges. The CVSS score of 3.1 signals low severity, and the EPSS score of less than 1% indicates a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, further suggesting limited active attacks. Based on the description, the likely attack vector is client‑side via form submission, which is inferred rather than explicitly stated.