CVE-2011-5189: Cross-site scripting (XSS) vulnerability in the Webform Validation module 6.x-1.x before 6.x-1.5 and 7.x-1....

Security readout for executives and security teams

CVE-2011-5189 is a cross-site scripting issue in Drupal’s Webform Validation module. A logged-in user with permission to update Webform nodes could inject script or HTML. This could affect site integrity and users viewing affected content, but the sources do not indicate unauthenticated exploitation or active exploitation. Exposure is likely limited to Drupal sites using the Webform Validation module in the affected version ranges and granting Webform node update permissions to authenticated users. Sites not using this module, or already on 6.x-1.5 or 7.x-1.1 or later, are not indicated as affected by the provided sources. Treat as a targeted cleanup item for legacy Drupal environments. Prioritize if the organization still runs Drupal 6 or 7 sites with Webform Validation and broad content-editing permissions. There is no sourced evidence of active exploitation, but XSS can still create user trust and session-risk concerns. Mitigation focus: Identify Drupal sites using the Webform Validation module.; Upgrade 6.x-1.x deployments to 6.x-1.5 or later.; Upgrade 7.x-1.x deployments to 7.x-1.1 or later..

Prepared

Jun 27, 2026, 18:16 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.