This vulnerability is an improper neutralization of input during web page generation, allowing stored cross‑site scripting in Drupal Webform. An attacker can inject malicious scripts via form submissions that are then rendered in the browser of any user viewing the form, potentially exposing session cookies, defacing content, or executing further attacks.

The vulnerability impacts the Drupal Webform module. Affected versions range from the initial release (0.0.0) through 6.2.12, and again from 6.3.0 to 6.3.1. Any installation of Webform within these ranges is at risk.

The CVSS score is 4.6, indicating moderate severity, and the EPSS score is < 1%, indicating a very low but nonzero exploitation probability, and it is not included in the CISA KEV catalog. Based on the description, the exploit requires an attacker to submit malicious input through a site that uses the vulnerable Webform module; the input is stored and later rendered to other users. While the exact probability of exploitation cannot be quantified, the stored nature of the payload makes it a serious concern for anyone who views the affected form.