An issue exists where the module does not sufficiently sanitize certain attributes, leading to cross-site scripting (XSS), a flaw that allows attackers to inject malicious scripts into web pages. Approximately 15,300 instances have been identified globally. Exploitation requires the attacker to possess a role with permission to enter HTML tags containing specific data attributes or the `administer menu` permission.