CVE-2011-5188: Cross-site scripting (XSS) vulnerability in the Support Timer module 6.x-1.x before 6.x-1.4 for Drupal allo...

Security readout for executives and security teams

This is an older Drupal module vulnerability that lets certain logged-in users place malicious script or HTML into Support Timer content. The risk is limited by requiring an authenticated account with the “track time spent” permission, but it can still affect other users who view the injected content. Exposure is likely limited to Drupal sites using the Support Timer module in the 6.x-1.x branch before 6.x-1.4. The vulnerable path requires a logged-in user with the “track time spent” permission, reducing internet-wide exploitability but not removing insider or compromised-account risk. Treat as a targeted cleanup item, not an emergency, unless the module is present on sensitive sites. Prioritize if untrusted users have the required permission or if the site handles privileged sessions, customer data, or administrative workflows. Mitigation focus: Upgrade Support Timer 6.x-1.x to 6.x-1.4 or later if still deployed.; Review Drupal advisory pages for any additional vendor guidance.; Remove or disable the module if it is no longer required..

Prepared

Jun 27, 2026, 18:16 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.