EUVD-2026-43055
GHSA-m44m-73vr-r5qh
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-delivered stored XSS with no auth required, scope change to victim browser, limited C/I impact, and no availability effect.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
4DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Advanced Content Feedback (aka admin_feedback) allows Stored XSS. This issue affects Advanced Content Feedback (aka admin_feedback) versions: from 0.0.0 to 2.8.0.
AnalysisAI
Stored XSS in the Drupal contributed module Advanced Content Feedback (admin_feedback) affects all releases from 0.0.0 up to 2.8.0, enabling a remote unauthenticated attacker to inject persistent malicious scripts that execute in the browsers of users who subsequently view affected pages. The scope change (S:C) in the CVSS vector indicates the injected payload escapes the application's security context and operates in the victim's browser, potentially enabling session hijacking or unauthorized actions on behalf of privileged users. No public exploit code has been identified and CISA has not added this to KEV; EPSS at 0.16% (6th percentile) and SSVC's 'exploitation: none' classification confirm this is a low-urgency finding with no evidence of active targeting.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause as a failure to encode or sanitize user-supplied input before it is reflected back in HTML rendered by a browser. In the stored XSS variant applicable here, attacker-supplied content is persisted server-side - most likely in Drupal's database - and is emitted without sufficient output encoding each time the affected page is rendered. The CPE string cpe:2.3:a:drupal:advanced_content_feedback_(aka_admin_feedback) identifies this as a Drupal contributed module (not Drupal core), meaning its presence is an administrative choice rather than a default. The module's name 'admin_feedback' suggests it surfaces content feedback within the Drupal admin UI, which is notable because stored XSS payload execution in an administrative context can carry elevated privilege impact even under the CVSS's limited C:L/I:L impact ratings.
RemediationAI
Upgrade the Advanced Content Feedback (admin_feedback) module to version 2.8.0 or later, as indicated by the EUVD affected-version boundary and the Drupal security advisory SA-contrib-2026-051 at https://www.drupal.org/sa-contrib-2026-051. If an immediate upgrade is not feasible, disabling the module removes the attack surface entirely; note that this also disables all admin feedback functionality for the site. As a partial compensating control, restricting access to pages that render feedback output to authenticated, trusted roles via Drupal's permission system reduces the pool of potential victims but does not eliminate the stored payload. Patch availability is confirmed per vendor advisory; the exact internal patch commit is not independently referenced in available data.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today