CVE-2014-8746: Cross-site scripting (XSS) vulnerability in the Skeleton theme 7.x-1.2 through 7.x-1.3 before 7.x-1.4, for...

Security readout for executives and security teams

CVE-2014-8746 is a cross-site scripting issue in the Drupal Skeleton theme. A logged-in user with the powerful "administer themes" permission could place unwanted script or HTML through theme settings. This matters mainly for Drupal sites that used Skeleton 7.x-1.2 or 7.x-1.3. Exposure appears limited to Drupal installations using the Skeleton theme versions 7.x-1.2 or 7.x-1.3, especially where non-core administrators can administer themes. Sites not using this theme, or already on 7.x-1.4 or later, are not indicated as affected by the provided sources. Treat this as a targeted legacy Drupal hygiene item, not an emergency internet-wide event. Prioritize if the organization still operates Drupal 7 sites with delegated theme administration or uncertain module and theme inventory. Mitigation focus: Upgrade the Drupal Skeleton theme to version 7.x-1.4 or later.; Restrict "administer themes" permission to highly trusted administrators only.; Review theme settings for unexpected HTML or script content..

Prepared

Jun 14, 2026, 13:53 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.