The Datafield module for Drupal provides a field type that supports structured data with multiple sub-fields and includes a Search - autocomplete widget. A vulnerability exists in the autocomplete endpoint where stored field values are not properly escaped before being returned as suggestion labels, leading to a potential cross-site scripting (XSS) issue. Exploitation requires the attacker to have permission to edit an entity containing a Datafield field and for the Search - autocomplete widget to be enabled on that field. Fixed versions 2.0.15 and 3.0.1 address this issue.