CVE-2013-0227: Cross-site scripting (XSS) vulnerability in the Search API Sorts module 7.x-1.x before 7.x-1.4 for Drupal a...

Security readout for executives and security teams

This is an authenticated cross-site scripting issue in a Drupal 7 contributed module. Users with certain roles could place script or HTML in field labels, potentially affecting people who later view those labels. The public record does not show active exploitation or a CVSS score. Exposure is likely limited to Drupal 7 sites using the Search API Sorts contributed module before 7.x-1.4. Risk depends on whether untrusted or lower-privileged authenticated users have roles that can influence affected field labels. Treat this as a targeted legacy-platform cleanup item, not an emergency from the available evidence. Prioritize if Drupal 7 remains internet-facing or if semi-trusted users can manage search configuration or labels. Mitigation focus: Upgrade Search API Sorts to 7.x-1.4 or later where deployed.; Check Drupal project guidance for any additional vendor-specific remediation.; Restrict roles that can manage or alter affected field labels..

Prepared

Jun 24, 2026, 11:46 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.