Drupal CookieCuttr contains a stored cross‑site scripting flaw because user input is not sanitized before being rendered into web pages. This weakness, classified as CWE‑79, allows an attacker to inject JavaScript that runs in the browsers of any site visitor who views the affected content, potentially hijacking sessions, defacing the site, or redirecting users to malicious destinations.

Products impacted are Drupal CookieCuttr versions 2.0.0 through 2.0.3. Any site that has one of these versions installed and exposes the affected functionality is susceptible to exploitation.

The CVSS score of 3.5 indicates low severity. The EPSS score is < 1 %, and the vulnerability is not listed in the CISA KEV catalog, implying no known public exploits. The attack vector is inferred to be through user‑controlled cookie values that are used in page output without sanitization; this inference is not directly stated in the advisory. Exploitation requires the attacker to supply malicious data, and the impact is confined to the victim’s browser context, but the extent of damage depends on the victim’s interactions after the script runs.