Feed Block
Monthly
Stored cross-site scripting in the Drupal Feed Block contrib module (versions before 2.0.2 on the 2.x line and before 3.0.2 on the 3.x line) allows an authenticated user who can supply or configure content rendered by the block to persist a script payload that executes in another user's browser when the affected block is rendered on a page. Impact is bounded to low confidentiality and low integrity in the victim's browser context, with no availability impact, and only sites running the Feed Block module are affected - sites without it are not exposed. Vendor patches are available (2.0.2 and 3.0.2), EPSS is very low at 0.16% (5th percentile), and no public exploit has been identified at time of analysis; this is a low-to-moderate priority, scheduled-patching item rather than an emergency.
Stored cross-site scripting in the Drupal Feed Block contrib module (versions before 2.0.2 on the 2.x line and before 3.0.2 on the 3.x line) allows an authenticated user who can supply or configure content rendered by the block to persist a script payload that executes in another user's browser when the affected block is rendered on a page. Impact is bounded to low confidentiality and low integrity in the victim's browser context, with no availability impact, and only sites running the Feed Block module are affected - sites without it are not exposed. Vendor patches are available (2.0.2 and 3.0.2), EPSS is very low at 0.16% (5th percentile), and no public exploit has been identified at time of analysis; this is a low-to-moderate priority, scheduled-patching item rather than an emergency.