CVE-2015-1621: Cross-site scripting (XSS) vulnerability in the Webform prepopulate block module before 7.x-3.1 for Drupal...

Security readout for executives and security teams

This is an older Drupal contributed-module XSS issue. An authenticated user could inject script or HTML through the Webform prepopulate block module before 7.x-3.1. The business risk is session abuse, content manipulation, or phishing inside the affected site, but the sources do not show active exploitation. Exposure is likely limited to Drupal sites that installed the Webform prepopulate block contributed module and kept it below 7.x-3.1. Sites without this module, or already on 7.x-3.1 or later, are not indicated as affected by the provided sources. Handle as a moderate-priority legacy Drupal hygiene item. It should be remediated in normal patch cycles, faster if the module is exposed to many authenticated users or high-privilege workflows. Mitigation focus: Upgrade Webform prepopulate block to 7.x-3.1 or later.; Review Drupal advisory pages for any additional vendor guidance.; Disable the module if it is unused or cannot be updated promptly..

Prepared

Jun 14, 2026, 05:11 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.