CVE-2014-8318: Cross-site scripting (XSS) vulnerability in the Webform module 6.x-3.x before 6.x-3.20, 7.x-3.x before 7.x-...

Security readout for executives and security teams

A Drupal Webform module flaw can let an authenticated user with specific permissions place script or HTML into a field label under a duplicate form_key condition. If triggered, the script could run in another user's browser. The public bundle does not provide CVSS scoring, CWE mapping, or evidence of active exploitation. Exposure is likely limited to Drupal sites running the affected Webform module versions where authenticated users have permissions to create or modify relevant webform fields. Public-facing Drupal sites with delegated content or form administration should be prioritized for inventory. Treat this as a targeted web application risk, not a confirmed emergency. Prioritize patching where Drupal Webform is internet-facing and non-admin users can manage forms. Lack of CVSS and exploitation evidence lowers certainty, but XSS can still affect sessions, trust, and administrative workflows. Mitigation focus: Upgrade Webform to 6.x-3.20, 7.x-3.20, 7.x-4.0-beta2, or later as applicable.; Review Drupal advisory guidance before applying compensating controls.; Restrict Webform field editing permissions to trusted administrators..

Prepared

Jun 14, 2026, 13:53 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.