This vulnerability affects the Drupal 7 Term Reference Tree module (7.x-1.x up to 7.x-1.11) and involves improper neutralization of input during web page generation (CWE-79). Specifically, two stored XSS vectors exist: (1) attacker-controlled token output in token display templates is rendered without proper sanitization if the Token module is enabled, allowing script injection via term descriptions; (2) taxonomy term labels are not sanitized before rendering in the widget, enabling script injection via term names. Exploitation requires permissions to create or edit taxonomy terms, and the malicious scripts execute when the relevant fields or forms are viewed.

Successful exploitation allows an attacker with limited permissions (to create or edit taxonomy terms) to inject and execute arbitrary JavaScript in the context of users viewing the affected fields or forms. This can lead to session hijacking, defacement, or other client-side attacks. The vulnerability has a CVSS 4.0 base score of 5.1 (medium severity), reflecting network attack vector, low complexity, and limited privileges required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict permissions to create or edit taxonomy terms to trusted users only. Consider disabling the Token module or token display templates if not required, as this reduces exposure to one of the XSS vectors. Monitor Drupal security advisories for updates and apply official patches once released.