CVE-2014-8747: Cross-site scripting (XSS) vulnerability in the Drupal Commons module 7.x-3.x before 7.x-3.9 for Drupal all...

Security readout for executives and security teams

CVE-2014-8747 is a cross-site scripting issue in the Drupal Commons module. A remote attacker could inject script or HTML through content creation or activity stream message paths. Business risk is highest for public or community sites where untrusted users can post content. Exposure is likely limited to Drupal 7 sites running the Commons module 7.x-3.x before 7.x-3.9, especially sites allowing broad content creation or community activity posting. Organizations not using Drupal Commons are not indicated as affected by the supplied sources. Prioritize remediation for public-facing Drupal Commons communities or intranets with many contributors. The issue is old and not KEV-listed, but unpatched XSS can still create account, trust, and brand-impact risk. Mitigation focus: Upgrade Drupal Commons to 7.x-3.9 or later where applicable.; Check Drupal advisory guidance for any additional vendor-recommended steps.; Restrict content creation and activity posting to trusted roles until remediated..

Prepared

Jun 14, 2026, 13:53 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.