CVE-2026-13231

Drupal Advanced Content Feedback versions 0.0.0 to 2.8.0 are vulnerable to a stored cross-site scripting (XSS) attack due to improper input neutralization during web page generation. This vulnerability could allow an attacker to inject malicious scripts that execute in the context of a user's browser, potentially compromising user data and session integrity. Organizations using the affected versions should prioritize patching this vulnerability to mitigate the risk of exploitation.