CVE-2015-4369: Cross-site scripting (XSS) vulnerability in the Trick Question module before 6.x-1.5 and 7.x-1.x before 7.x...

Security readout for executives and security teams

This is an XSS issue in Drupal's contributed Trick Question module. A user who already has the "Administer Trick Question" permission could inject script or HTML. The sources do not show broad unauthenticated exposure or active exploitation. Exposure is likely limited to Drupal deployments that installed the Trick Question module and granted its administration permission to users. Sites not using this contributed module are not indicated as affected by the provided sources. Prioritize remediation where the module is installed on business-facing Drupal sites or where many users have administrative permissions. Treat as lower urgency than unauthenticated remote code execution, but do not ignore privileged XSS risk. Mitigation focus: Upgrade Trick Question to 6.x-1.5, 7.x-1.5, or later as applicable.; Review Drupal vendor advisory guidance for the deployed branch.; Restrict "Administer Trick Question" to trusted administrators only..

Prepared

Jun 13, 2026, 22:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.