AI SEO/GEO Analyzer CVE-2026-15085

Exploitation requires an authenticated Drupal account with at least low-level permissions to interact with the AI SEO/GEO Analyzer module (PR:L per CVSS vector) - anonymous or unauthenticated users cannot trigger this vulnerability. The Drupal site must have the AI SEO/GEO Analyzer contrib module installed and enabled in a version prior to 1.1.3. Additionally, a separate victim user with sufficient privileges must actively browse to or render the page or view containing the stored payload (UI:R per CVSS vector), meaning exploitation cannot be completed without this second-party trigger. Factors limiting exploitation: the attacker cannot self-trigger the payload for privilege escalation without a victim; the stored payload is only dangerous until the module is updated or the malicious content is purged; and Drupal's role-based access controls may further restrict who can submit analyzer inputs depending on site configuration.

The CVSS 3.1 base score of 5.4 (Medium) is appropriate and internally consistent: AV:N reflects network delivery, AC:L indicates no special race conditions, PR:L confirms a low-privilege authenticated account is required as a prerequisite, and UI:R requires victim interaction - both conditions that meaningfully constrain the attack surface. The scope change (S:C) with C:L/I:L reflects that the impact escapes the vulnerable Drupal application context and affects the victim's browser session. EPSS at 0.25% in the 17th percentile is low, suggesting this vulnerability is not actively targeted by threat actors and lacks known exploit tooling at time of analysis. The absence of a KEV listing and any POC references further supports a low urgency posture. Real-world risk is therefore primarily relevant to Drupal sites where multiple low-privilege user roles can interact with the AI SEO/GEO Analyzer module and where administrators regularly view contributor-submitted data. This is not a zero-effort attack - both authenticated access and a victim browsing the affected page are required - but the stored nature of the payload amplifies reach compared to reflected XSS.

An attacker with a low-privilege Drupal account (such as an editor or authenticated content contributor) navigates to an AI SEO/GEO Analyzer input field and submits a crafted payload containing JavaScript - for example, within an SEO analysis text field or metadata input. The payload is stored in the Drupal database and later rendered unsanitized when a higher-privileged user (such as a site administrator) views the associated content or report. The administrator's browser executes the injected script, potentially exfiltrating their session cookie to an attacker-controlled server or performing administrative actions on their behalf. No public proof-of-concept code has been identified at time of analysis.