CVE-2013-4380: Cross-site scripting (XSS) vulnerability in the MediaFront module 6.x-1.x before 6.x-1.6, 7.x-1.x before 7....

Security readout for executives and security teams

This is a stored cross-site scripting issue in the Drupal MediaFront module. A logged-in user with the "administer mediafront" permission could place script or HTML into preset settings. Risk is concentrated where that permission is broadly granted or where administrator browsers access untrusted presets. Exposure is likely limited to Drupal sites using the MediaFront contributed module in the named vulnerable branches. Systems without MediaFront, or without users granted "administer mediafront," are less likely to be exposed based on the source bundle. Prioritize for Drupal environments that still run legacy MediaFront versions or delegate MediaFront administration beyond core trusted staff. This is not shown as actively exploited in the bundle, but XSS in administrative workflows can create meaningful account and content integrity risk. Mitigation focus: Upgrade MediaFront 6.x-1.x to 6.x-1.6 or later.; Upgrade MediaFront 7.x-1.x to 7.x-1.6 or later.; Upgrade MediaFront 7.x-2.x to 7.x-2.1 or later..

Prepared

Jun 14, 2026, 14:16 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.