CVE-2014-7869: Cross-site scripting (XSS) vulnerability in the configuration UI in the Context Form Alteration module 7.x-...

Security readout for executives and security teams

This is an admin-area XSS issue in a Drupal module. It matters if a Drupal 7 site uses Context Form Alteration 7.x-1.x before 7.x-1.2 and grants users the "administer contexts" permission. A permitted user could inject script or HTML into the configuration UI. Sources do not show broad unauthenticated exposure. Likely limited to Drupal 7 installations with the Context Form Alteration module installed at vulnerable 7.x-1.x versions and delegated context administration permissions. Internet exposure depends on whether authenticated users can access the affected configuration UI. Treat as a targeted administrative-risk cleanup, not an emergency internet-wide incident based on available evidence. Prioritize sites where Drupal 7 is still used, the vulnerable module is installed, or context administration is delegated outside a small trusted group. Mitigation focus: Upgrade Context Form Alteration to 7.x-1.2 or later where applicable.; Review Drupal advisory guidance before changing production sites.; Restrict "administer contexts" to trusted administrators only..

Prepared

Jun 14, 2026, 13:53 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.