CVE-2014-3933: Cross-site scripting (XSS) vulnerability in the address components field formatter in the AddressField Toke...

Security readout for executives and security teams

This is an authenticated cross-site scripting issue in a Drupal add-on. A user with access to enter address data could store script or HTML in an address field, causing it to run for later viewers. Business impact depends on who can create or edit those fields and who views the formatted output. Exposure is likely limited to Drupal 7 sites using the AddressField Tokens module before 7.x-1.4, with authenticated users able to submit or edit address fields. Sites not using this module, or already updated to 7.x-1.4 or later, are not indicated as affected by the provided sources. Prioritize remediation for public or partner-facing Drupal sites where semi-trusted users can edit address data. This is not marked as known exploited, but stored XSS can support account compromise if administrators or customers view malicious content. Mitigation focus: Upgrade AddressField Tokens to version 7.x-1.4 or later where applicable.; Review Drupal advisory guidance before applying production changes.; Restrict address field editing to trusted roles until remediation is complete..

Prepared

Jun 14, 2026, 14:16 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.