CVE-2010-1303: Multiple cross-site scripting (XSS) vulnerabilities in the Taxonomy Filter module 6.x before 6.x-1.1 for Dr...

Security readout for executives and security teams

This issue affects older Drupal sites using the Taxonomy Filter module 6.x before 6.x-1.1. Certain authenticated users could place script or HTML into taxonomy-related fields, creating a cross-site scripting risk for people who later view affected pages or menus. Exposure is likely limited to legacy Drupal 6 installations with the Taxonomy Filter module installed below 6.x-1.1 and permissive taxonomy or node-creation roles. Sites without this module, without Drupal 6, or without those user permissions are not indicated as affected by the bundle. Treat this as a legacy-platform hygiene issue with moderate urgency. It is not described as actively exploited, but any internet-facing Drupal 6 site with broad content or taxonomy permissions should be remediated quickly because XSS can compromise sessions and administrative workflows. Mitigation focus: Upgrade Taxonomy Filter 6.x to 6.x-1.1 or later vendor-supported guidance.; Restrict administer taxonomy permission to trusted administrators only.; Disable or tightly limit free tagging where untrusted users can create nodes..

Prepared

Jun 28, 2026, 02:49 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.