CVE-2013-2177: Cross-site scripting (XSS) vulnerability in the Display Suite module 7.x-1.x before 7.x-1.7 and 7.x-2.x bef...

Security readout for executives and security teams

This is a stored cross-site scripting issue in Drupal’s Display Suite module. A logged-in user with specific permissions could place script or HTML in an entity bundle label. If viewed by another user, that content could run in the browser. Public sources do not provide CVSS severity or evidence of active exploitation. Exposure is likely limited to Drupal sites using the Display Suite module in the affected 7.x branches, especially where non-administrative authenticated users can manage or influence entity bundle labels. Treat as a moderate-priority remediation for legacy Drupal 7 estates. Prioritize sites with many authenticated contributors, delegated administration, or sensitive administrator sessions. No public source in the bundle confirms active exploitation. Mitigation focus: Upgrade Display Suite 7.x-1.x to 7.x-1.7 or later.; Upgrade Display Suite 7.x-2.x to 7.x-2.3 or later.; Review Drupal advisory guidance before changing production systems..

Prepared

Jun 14, 2026, 22:07 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.