Drupal Form Builder Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in the Drupal Form Builder module, specifically in versions 7.x-1.0 through 7.x-1.22. This vulnerability arises from improper sanitization of JSON data, which allows for the injection of malicious scripts that could be executed in the context of the user's browser. Exploitation requires a role with permission to input specially formatted HTML link tags containing the malicious payload.

Impact

Exploitation of this vulnerability allows for persistent cross-site scripting, where injected scripts are executed in the context of the user.

Remediation

Users can upgrade to Form Builder version 7.x-1.23 or 7.x-2.0-alpha9. HeroDevs customers can access the patched version through their Never-Ending Support.