CVE-2026-13231
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
A stored Cross-Site Scripting (XSS) vulnerability has been found in the Drupal Advanced Content Feedback (admin_feedback) module. The flaw stems from improper input neutralization during web page generation.
Risk Assessment
An attacker can hijack user sessions, steal data, or perform other malicious actions in the victim's browser context. The risk is especially high in multi-user environments.
Recommendation
Immediately update the Advanced Content Feedback module to version 2.8.1 or later, which includes a fix for this vulnerability.
Other vulnerabilities in Drupal Advanced Content Feedback
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Advanced Content Feedback (aka admin_feedback) allows Stored XSS. This issue affects Advanced Content Feedback (aka admin_feedback) versions: from 0.0.0 to 2.8.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS