CVE-2015-4370: Cross-site scripting (XSS) vulnerability in the Site Documentation module before 6.x-1.5 for Drupal allows...

Security readout for executives and security teams

This issue affects Drupal sites using the Site Documentation module before 6.x-1.5. An authenticated user with certain permissions could inject script or HTML through taxonomy-term-related content. That could let malicious content run in another user’s browser inside the trusted site context. Exposure is likely limited to Drupal installations that installed the Site Documentation module and have not updated it past 6.x-1.5. Sites without this module, or without affected authenticated permission paths, are not indicated as affected by the provided sources. Treat as a targeted web application risk for legacy Drupal environments, not as a confirmed mass-exploitation emergency. Prioritize if the affected module is present on public or administrator-facing sites, especially where many authenticated users can manage taxonomy-related content. Mitigation focus: Identify Drupal sites using the Site Documentation module.; Confirm whether the module version is earlier than 6.x-1.5.; Update the module to 6.x-1.5 or later per Drupal guidance..

Prepared

Jun 13, 2026, 22:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.