CVE-2014-9346: Multiple cross-site scripting (XSS) vulnerabilities in the Hierarchical Select module 6.x-3.x before 6.x-3....

Security readout for executives and security teams

This is an authenticated XSS issue in the Drupal Hierarchical Select module. Users with specific permissions could inject script or HTML through taxonomy term titles or entity type fields, depending on configuration. The main business risk is session misuse, content tampering, or administrator browser compromise on affected Drupal 6 sites. Exposure appears limited to Drupal sites running Hierarchical Select 6.x-3.x before 6.x-3.9, with authenticated users holding permissions that reach the affected taxonomy or entity field paths. Treat as a targeted cleanup item for legacy Drupal environments, not an internet-wide emergency. Prioritize if external users, contractors, or many editors can create taxonomy terms or edit affected entity fields. Mitigation focus: Upgrade Hierarchical Select to 6.x-3.9 or later where applicable.; Review Drupal advisory guidance before applying any workaround.; Restrict affected authenticated permissions until the module is updated..

Prepared

Jun 14, 2026, 05:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.