CVE-2014-8744: Cross-site scripting (XSS) vulnerability in the Nivo Slider module 7.x-2.x before 7.x-1.11 for Drupal allow...

Security readout for executives and security teams

CVE-2014-8744 is a cross-site scripting issue in the Drupal Nivo Slider module. A user who already has the "administer nivo slider" permission could inject script or HTML through an image title. Available sources do not show unauthenticated exploitation or active exploitation. Exposure is likely limited to legacy Drupal sites using the Nivo Slider module and granting the specific administration permission. Sites without this module or without delegated Nivo Slider administration are not indicated as exposed by the supplied sources. Treat this as a targeted cleanup item for legacy Drupal assets, not an emergency internet-wide issue. Prioritize if the module is installed on public-facing sites or if many non-admin users hold the Nivo Slider administration permission. Mitigation focus: Inventory Drupal sites for the Nivo Slider module and version.; Check Drupal advisory pages for the corrected release and upgrade guidance.; Restrict "administer nivo slider" to trusted administrators only..

Prepared

Jun 14, 2026, 13:53 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.