The vulnerability, described as a Privilege Defined With Unsafe Actions in Drupal Webform, permits attackers to inject stored XSS payloads through form submissions. The injected script is executed when the form is viewed, enabling session hijacking, data theft, or defacement of content. The weakness involved is reflected in a CWE that signals improper authorization controls, although the practical effect is an XSS flaw that could affect both authenticated and unauthenticated users who can view the compromised form.

Drupal Webform is affected. All releases from the initial version 0.0.0 up to 6.2.12, as well as the 6.3.0 and 6.3.1 releases, contain the flaw. Any site using these versions without remediation is vulnerable.

The CVSS score of 4.6, the EPSS score of < 1%, and the status of not listed in KEV indicate that the vulnerability is moderately impactful but has a low probability of exploitation. Nonetheless, the stored nature of the payload and its ability to run within the context of a legitimate user’s session place it at moderate risk. Attackers would need to input malicious data into a form that can be rendered for other users, typically requiring some level of permission to create or edit forms. Once injected, the script operates with the privileges of the victim, making potential impact substantial.