CVE-2013-4447: Cross-site scripting (XSS) vulnerability in the API in the Simplenews module 6.x-1.x before 6.x-1.5 and 7.x...

Security readout for executives and security teams

CVE-2013-4447 is a cross-site scripting issue in the Drupal Simplenews module. A remote attacker could place script or HTML in an email address field, potentially affecting people who later view that value. Organizations only face this issue if they run affected Simplenews 6.x or 7.x releases. Exposure is limited to Drupal sites using the Simplenews module on the affected release branches. The bundle does not identify core Drupal as affected, and the CPE/product fields are incomplete. Asset owners should verify module presence and exact version rather than assuming exposure. Prioritize remediation for public Drupal sites using Simplenews, especially where untrusted users can submit newsletter subscriptions. This is not KEV-listed in the provided bundle, but XSS can still create account, content, and trust risks if administrators view attacker-controlled data. Mitigation focus: Upgrade Simplenews 6.x-1.x to 6.x-1.5 or later.; Upgrade Simplenews 7.x-1.x to 7.x-1.1 or later.; Review the Drupal advisory for any branch-specific guidance..

Prepared

Jun 14, 2026, 15:13 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.