CVE-2015-4354: Cross-site scripting (XSS) vulnerability in the Ubercart Webform Integration module before 6.x-1.8 and 7.x...

Security readout for executives and security teams

This flaw affects the Drupal Ubercart Webform Integration module. A logged-in user with specific permissions could place script or HTML into the site through unspecified paths. If triggered, that script could run in another user's browser, creating session, content-integrity, or administrative-action risk. Exposure is limited to Drupal sites that installed the Ubercart Webform Integration contributed module on affected 6.x or 7.x branches. Risk is higher where non-admin or less-trusted authenticated users have the relevant module permissions. Treat as a targeted cleanup item unless the module is present on externally used Drupal sites with many authenticated users. If present, prioritize patching because XSS can undermine user trust and administrative sessions. Mitigation focus: Upgrade the module to 6.x-1.8, 7.x-2.4, or later applicable releases.; Review Drupal advisory pages for branch-specific guidance and release notes.; Restrict relevant Webform/Ubercart permissions to trusted roles until patched..

Prepared

Jun 13, 2026, 22:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.