CVE-2007-4363: Multiple cross-site scripting (XSS) vulnerabilities in the nodereference module in Drupal Content Construct...

Security readout for executives and security teams

This is an old Drupal CCK nodereference cross-site scripting issue. A remote attacker could cause malicious script or HTML to be stored or displayed through affected nodereference fields. Business risk depends on whether legacy Drupal sites still run the vulnerable CCK versions and affected field configurations. Exposure is likely limited to legacy Drupal deployments using CCK nodereference versions older than 4.7.x-1.6 or 5.x-1.6, especially where affected formatter or autocomplete widget configurations exist. The supplied product metadata is incomplete. Treat as a legacy exposure cleanup item unless an internet-facing Drupal 4.7 or 5 site still uses the affected CCK nodereference configurations. Prioritize any such public sites because XSS can affect users and administrators through trusted pages. Mitigation focus: Upgrade affected Drupal CCK nodereference to 4.7.x-1.6, 5.x-1.6, or later where applicable.; Review the referenced Drupal advisories before applying configuration changes.; Temporarily avoid the plain formatter for nodereference fields until remediated..

Prepared

Jun 29, 2026, 04:07 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.