CVE-2009-1738: Cross-site scripting (XSS) vulnerability in Feed Block 6.x-1.x before 6.x-1.1, a module for Drupal, allows...

Security readout for executives and security teams

This is an older Drupal module issue affecting Feed Block 6.x-1.x before 6.x-1.1. A logged-in user with administrator feed permissions could inject script or HTML into aggregator items. Business risk depends on whether the module is installed and whether trusted users have those permissions. Exposure is likely limited to legacy Drupal 6 sites running the Feed Block module 6.x-1.x before 6.x-1.1. Sites without this contributed module, or without users holding administrator feed permissions, are not indicated as affected by the provided sources. Treat as a targeted legacy exposure check, not an emergency unless affected Drupal 6 systems remain in production. Prioritize internet-facing or administrator-heavy sites, then remove the module, upgrade it, or restrict permissions based on operational need. Mitigation focus: Upgrade Feed Block to 6.x-1.1 or later if the module is still required.; Disable or remove Feed Block where it is not needed.; Restrict administrator feed permissions to trusted maintainers only..

Prepared

Jun 28, 2026, 10:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.