The vulnerability in Drupal Webform arises from a privilege‑defined unsafe action that stores malicious input in the database and renders it without proper escaping, leading to stored cross‑site scripting. An attacker who can inject input that is later displayed to other users can run arbitrary JavaScript in the victim’s browser, potentially hijacking sessions, defacing content, or stealing sensitive data. The flaw is a type of incorrect permission assignment (CWE‑267).

Drupal Webform module, versions 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1. Users running these versions are impacted.

Because the payload is stored and served from the database, any user who can create or edit a form with the unsafe action can install the XSS payload. The threat requires a privileged user, but once stored, the attack can be executed by any visitor to the page. The CVSS score is 5.4, and the EPSS score is < 1%, indicating a moderate likelihood of exploitation in environments where privileged users create forms. The vulnerability is not currently listed in the CISA KEV catalog.