CVE-2014-9498: Cross-site scripting (XSS) vulnerability in the Webform Invitation module 7.x-1.x before 7.x-1.3 and 7.x-2....

Security readout for executives and security teams

This is an authenticated cross-site scripting issue in Drupal's Webform Invitation module. A user with webform content creation or editing rights could place script or HTML in a node title. The main business risk is malicious browser-side actions against staff or administrators who view affected content. Exposure is most likely on legacy Drupal 7 sites using the Webform Invitation module, especially where non-administrator users can create or edit webform content. Sites without this contributed module, or without those permissions granted to untrusted users, are less likely to be affected. Prioritize remediation for any internet-facing Drupal 7 site that still uses this module and allows delegated webform editing. The risk is not evidenced as actively exploited here, but stored XSS can undermine trusted administrator sessions and damage site integrity. Mitigation focus: Upgrade Webform Invitation 7.x-1.x to 7.x-1.3 or later.; Upgrade Webform Invitation 7.x-2.x to 7.x-2.4 or later.; Review Drupal roles with Webform create or edit permissions..

Prepared

Jun 14, 2026, 05:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.