The vulnerability identified as CVE-2026-13231 affects the Drupal Advanced Content Feedback (admin_feedback) module, specifically versions from 0.0.0 through 2.8.0. It is classified as CWE-79, indicating improper neutralization of input during web page generation, which leads to stored cross-site scripting (XSS). This flaw allows an attacker to inject malicious scripts that are stored by the application and later executed in the context of users' browsers, potentially compromising user sessions or data. The vulnerability is published but lacks a CVSS score and vendor-provided remediation details. No evidence of active exploitation has been reported.

Successful exploitation of this vulnerability could allow attackers to execute arbitrary scripts in the browsers of users who view the affected content, potentially leading to session hijacking, defacement, or other client-side attacks. The impact is limited to the affected module and its users. There is no indication of remote code execution or server compromise from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users of the affected versions should monitor the Drupal security advisories for updates. In the meantime, consider applying input validation or output encoding workarounds if feasible, or disabling the affected module if it is not essential.