EUVD-2026-43080
GHSA-xg2f-c7h9-qw99
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Stored XSS requires low-privilege authenticated submission (PR:L), victim page view (UI:R), and scope change captures cross-browser-context impact (S:C); no availability impact applies.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
4DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI SEO/GEO Analyzer allows Stored XSS. This issue affects AI SEO/GEO Analyzer versions: from 0.0.0 to 1.1.3.
AnalysisAI
Stored Cross-Site Scripting in the Drupal AI SEO/GEO Analyzer contrib module (versions 0.0.0 through pre-1.1.3) enables authenticated low-privilege users to persist malicious JavaScript payloads that execute in the browser context of other users - including administrators - who subsequently view the affected content. The scope change (S:C in the CVSS vector) confirms cross-context execution, enabling session hijacking, credential theft, or unauthorized DOM manipulation against victim users. EPSS probability stands at 0.25% (17th percentile) and no active exploitation has been reported in CISA KEV, indicating limited real-world threat at this time. A vendor-released patch is available via the Drupal security advisory SA-contrib-2026-076.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) describes the root cause: user-supplied input processed by the AI SEO/GEO Analyzer module is stored and later rendered in HTML pages without adequate sanitization or encoding. This is a stored (persistent) XSS variant, meaning the payload survives server-side and is delivered to all subsequent page viewers rather than requiring per-request social engineering. The affected product is a Drupal contributed module identified by CPE cpe:2.3:a:drupal:ai_seo/geo_analyzer:*:*:*:*:*:*:*:*, designed to perform AI-assisted SEO and GEO content analysis within the Drupal CMS. Stored XSS in Drupal contrib modules typically manifests in user-editable fields (meta tags, analysis inputs, or configuration labels) that are later displayed in administrative or content views, bypassing Drupal's content security policies when module-level filtering is absent.
RemediationAI
The primary remediation is to upgrade the AI SEO/GEO Analyzer Drupal module to version 1.1.3 or later, per the Drupal security advisory at https://www.drupal.org/sa-contrib-2026-076. Site administrators should apply this update via Drush (drush up ai_seo_geo_analyzer) or through the Drupal admin interface under Manage > Reports > Available updates. If an immediate upgrade is not feasible, a compensating control is to restrict access to the AI SEO/GEO Analyzer input functionality to only highly trusted roles (e.g., administrators), thereby eliminating the low-privilege attacker prerequisite captured in PR:L of the CVSS vector. Additionally, enforcing a strict Content Security Policy (CSP) header that blocks inline script execution can limit XSS exploitability, though this does not eliminate the root cause and may interfere with other Drupal module functionality. Disabling the module entirely is an option for sites that do not actively use it, with the trade-off of losing AI SEO analysis capabilities.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today