A stored cross-site scripting (XSS) vulnerability exists in the Drupal Signature pad widget. This flaw is due to improper neutralization of input during web page generation, allowing malicious scripts to be stored and executed in users' browsers. The vulnerability affects Signature pad widget versions from 0.0.0 up to and including 1.15.0.