CVE-2015-4386: Multiple cross-site scripting (XSS) vulnerabilities in unspecified administration pages in the EntityBulkDe...

Security readout for executives and security teams

CVE-2015-4386 is an XSS issue in the Drupal EntityBulkDelete contributed module 7.x-1.0. An attacker could store script or HTML through content-related workflows, then have it run when affected administration pages render that data. Business impact depends on whether the module is installed and who can create or edit comments, taxonomy terms, or nodes. Exposure is likely limited to Drupal 7 sites running EntityBulkDelete module 7.x-1.0. Risk increases where untrusted or lower-privileged users can create or edit comments, taxonomy terms, or nodes that administrators later view in affected admin pages. Treat this as a targeted remediation item, not an emergency based on current evidence. Prioritize any public or multi-user Drupal 7 site using EntityBulkDelete 7.x-1.0, especially where administrators review user-generated content. Mitigation focus: Identify Drupal sites using EntityBulkDelete 7.x-1.0.; Check the Drupal advisory and project page for official fixed-version guidance.; Remove or disable the module where it is not required..

Prepared

Jun 13, 2026, 22:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.