CVE-2015-4376: Cross-site scripting (XSS) vulnerability in the Profile2 Privacy module 7.x-1.x before 7.x-1.5 for Drupal a...

Security readout for executives and security teams

This vulnerability affects Drupal sites using the Profile2 Privacy contributed module before 7.x-1.5. A signed-in user with a specific Profile2 Privacy administration permission could inject script or HTML, potentially affecting administrators or users who later view the impacted content. Exposure is likely limited to Drupal installations that have the Profile2 Privacy module installed at a vulnerable 7.x-1.x version and grant the affected permission to users. Sites without this contributed module, or already on 7.x-1.5 or later, are not indicated as affected by the provided sources. Treat this as a targeted cleanup item, not a broad emergency, unless many users hold the affected permission. Prioritize internet-facing or high-trust Drupal properties where delegated administrators could modify privacy settings viewed by privileged users. Mitigation focus: Upgrade Profile2 Privacy to 7.x-1.5 or later where applicable.; Review Drupal roles granted "Administer Profile2 Privacy Levels".; Remove that permission from nonessential or untrusted accounts..

Prepared

Jun 13, 2026, 22:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.