Drupal Simple multi step form versions before 2.0.0 contain a Cross-Site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This vulnerability allows an attacker with high privileges and requiring user interaction to inject malicious scripts, potentially leading to limited confidentiality and integrity impacts. The issue is fixed in version 2.0.0.