CVE-2014-8745: Cross-site scripting (XSS) vulnerability in the Custom Search module 6.x-1.x before 6.x-1.13 and 7.x-1.x be...

Security readout for executives and security teams

This issue affects Drupal sites using the Custom Search module. A user who can administer taxonomy could place malicious script or HTML in a vocabulary label, potentially affecting administrators or visitors who view rendered search-related content. The reported condition is permission-gated, so exposure depends on who holds that Drupal permission. Likely exposure is limited to Drupal 6 or 7 deployments using vulnerable Custom Search module versions and granting administer taxonomy to non-fully-trusted users. Public anonymous exploitation is not supported by the provided sources. Prioritize remediation for externally facing Drupal sites where taxonomy administration is delegated. This is not supported as actively exploited, but stored XSS can undermine administrator trust and session safety if a privileged user abuses access or an account is compromised. Mitigation focus: Upgrade Custom Search to 6.x-1.13 or 7.x-1.15 as applicable.; Review Drupal vendor guidance for any additional site-specific steps.; Restrict administer taxonomy permission to trusted administrators only..

Prepared

Jun 14, 2026, 13:53 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.