CVE-2015-4373: Cross-site scripting (XSS) vulnerability in the OG tabs module before 7.x-1.1 for Drupal allows remote auth...

Security readout for executives and security teams

This CVE describes a stored cross-site scripting issue in the Drupal OG tabs contributed module before 7.x-1.1. An authenticated user with specific permissions could place script or HTML through Organic Groups node-related content. Business risk depends on whether the module is installed and who can create or edit affected group content. Likely exposure is limited to Drupal sites using the OG tabs module before 7.x-1.1, especially with Organic Groups enabled and authenticated users granted relevant content permissions. Generic Drupal installations without this contributed module are not evidenced as affected here. Treat this as a targeted cleanup item for legacy Drupal environments, not a broad emergency. Prioritize if the organization runs Drupal with OG tabs and allows many authenticated contributors or external community users. Mitigation focus: Upgrade the OG tabs module to 7.x-1.1 or later if installed.; Review Drupal advisory guidance for any site-specific remediation notes.; Restrict Organic Groups node creation or editing permissions to trusted users..

Prepared

Jun 13, 2026, 22:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.