CVE-2014-5456: Cross-site scripting (XSS) vulnerability in the Social Stats module before 7.x-1.5 for Drupal allows remote...

Security readout for executives and security teams

This CVE affects the Drupal Social Stats module before 7.x-1.5. Authenticated users who can create certain content may be able to insert script or HTML that runs in other users' browsers. Risk depends on whether the module is installed and who has content creation rights. Exposure is likely limited to Drupal sites running the Social Stats module before 7.x-1.5, especially where non-admin users can create affected content types. Sites not using this module are not indicated as affected by the supplied sources. Treat this as a targeted web application risk, not a confirmed emergency. Prioritize if Drupal 7 sites still exist, the module is installed, or many authenticated users can create content. Remediation should fit normal vulnerability management timelines unless exposure is broad internally. Mitigation focus: Identify Drupal sites using the Social Stats module.; Upgrade Social Stats to 7.x-1.5 or later where applicable.; Restrict content creation permissions to trusted roles..

Prepared

Jun 14, 2026, 07:14 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.