CVE-2013-5964: Cross-site scripting (XSS) vulnerability in the administration page in the Flag module 7.x-3.x before 7.x-3...

Security readout for executives and security teams

This issue affects the Drupal Flag module 7.x-3.x before 7.x-3.1. A logged-in user with the “Administer flags” permission could place script or HTML in a flag title, affecting the administration page. The source bundle does not show public active exploitation or a CVSS score. Exposure is most likely on legacy Drupal 7 sites using the Flag module 7.x-3.x below 7.x-3.1, especially where non-core administrators hold “Administer flags.” Sites not using this module or permission path are not indicated as affected by the bundle. Treat as a targeted legacy Drupal risk. Prioritize remediation where Drupal 7 and the Flag module remain in production, especially if administrative permissions are broadly delegated. This is not evidenced as internet-wide unauthenticated exploitation in the supplied sources. Mitigation focus: Upgrade the Drupal Flag module to 7.x-3.1 or later.; Restrict “Administer flags” to trusted administrative users only.; Review existing flag titles for unexpected HTML or script content..

Prepared

Jun 14, 2026, 15:32 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.