CVE-2010-1984: Cross-site scripting (XSS) vulnerability in the Taxonomy Breadcrumb module 5.x before 5.x-1.5 and 6.x befor...

Security readout for executives and security teams

This is a stored cross-site scripting issue in Drupal's Taxonomy Breadcrumb module. A logged-in user with permission to administer taxonomy could place script or HTML in a taxonomy term name that is later shown in breadcrumb output. The source bundle does not show active exploitation or a CVSS score. Exposure is likely limited to Drupal sites using the Taxonomy Breadcrumb module on affected 5.x or 6.x releases, especially where non-core administrators can administer taxonomy terms. Treat as a targeted cleanup item, not an emergency based on the supplied evidence. Prioritize affected public Drupal sites where many users have taxonomy administration rights. Mitigation focus: Upgrade Taxonomy Breadcrumb to 5.x-1.5, 6.x-1.1, or later vendor-supported releases.; Restrict administer taxonomy permission to trusted site administrators only.; Check Drupal project advisories for any additional vendor guidance..

Prepared

Jun 28, 2026, 02:49 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.