Mother May I EUVD-2026-43093

Exploitation requires that the Drupal site has the 'Mother May I' contrib module installed and enabled and that an attacker can reach an input field the module renders back into a page; the effective trigger is a victim (often an admin) viewing the page containing the injected payload, so despite the published UI:N metric, XSS of this class realistically depends on user interaction with the poisoned content. Limiting factors: the module is not part of Drupal core, so only sites that chose to install it are exposed; impact is confined to the browser/session of users who view the affected output; and whether unauthenticated injection is possible depends on the specific field's access controls, which are not specified in the available data (the empty description '*.*' provides no concrete feature/config prerequisite). This is therefore not an unauthenticated full-server-compromise scenario in practice despite the 9.8 base score.

The signals conflict sharply and should be reconciled before prioritization. The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) is inconsistent with a CWE-79 XSS: XSS realistically requires user interaction (UI:R), usually causes a scope change (S:C) into the victim's browser, and rarely yields full C:H/I:H/A:H on the server - so the 9.8 appears inflated relative to the vulnerability class. Corroborating this, EPSS is only 0.15% (5th percentile), the flaw is NOT in CISA KEV, and no POC is referenced, so real-world exploitation pressure is currently low. This reads as a high-nominal-CVSS-but-modest-real-risk issue: genuine and worth patching, but not an emergency for most sites, and its true impact depends on whether the injection is stored (higher risk, hits admins) or reflected (requires luring a victim). Recommend verifying the true CVSS with the Drupal advisory, as the NVD/reporter score likely overstates severity.

An attacker submits a crafted value containing HTML/JavaScript into a field processed by the Mother May I module; when a Drupal user or administrator later views the page that renders that value, the script executes in their authenticated session. Given the network attack vector and low complexity, the attacker could use this to steal session cookies, perform actions as the victim, or attempt to escalate toward administrative control. No public POC is referenced, so exploitation would require an attacker to independently craft the payload.