CVE-2026-15085 is a stored cross-site scripting (CWE-79) vulnerability in the Drupal AI SEO/GEO Analyzer module. It arises from improper neutralization of input during web page generation, allowing attackers with low privileges and requiring user interaction to inject and execute malicious scripts. The vulnerability affects versions from 0.0.0 through 1.1.3. No official patch or remediation guidance has been provided by the vendor at this time.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of other users, potentially leading to information disclosure or session hijacking. The vulnerability requires low privileges and user interaction, and the impact is limited to confidentiality and integrity with no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with untrusted input and consider disabling or restricting use of the affected module. Monitor the vendor's security advisories for updates on patches or official mitigations.