This module provides a field type for storing structured data with multiple sub-fields, along with several widgets including a Search - autocomplete widget. The module’s autocomplete endpoint does not sufficiently escape stored field values before returning them as suggestion labels, which can allow cross-site scripting. This vulnerability is mitigated by the fact that the attacker must have permission to edit an entity carrying a Data Field field. The Search - autocomplete widget must also be configured on that field.