This vulnerability, tracked as CVE-2026-13231, involves improper input sanitization in the Drupal Advanced Content Feedback module, leading to stored cross-site scripting (CWE-79). The flaw allows attackers to inject malicious scripts that are stored and later executed in the context of users viewing the affected content. The affected versions include all releases from 0.0.0 up to 2.8.0. The vulnerability has a CVSS 3.1 score of 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality and integrity with no availability impact. No vendor advisory or patch information is provided, and the module is not a cloud service, so remediation depends on module updates or configuration changes by site administrators.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of users viewing the affected Drupal module's content. This can lead to disclosure of sensitive information, session hijacking, or other actions limited to the confidentiality and integrity of the affected system. There is no impact on availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, administrators should monitor the Drupal security advisories for updates. In the meantime, consider applying input validation or output encoding workarounds if feasible, or restrict usage of the affected module until a fix is released.