drupal Term Reference Tree vulnerabilities

Latest drupal Term Reference Tree CVEs

Newest publication first

1. CVE-2026-4093 Stored XSS in Drupal 7 Term Reference Tree module (token display templates and term labels)

   Published 2026-05-21

   Medium·CVSS 5.1

   In the Drupal 7 Term Reference Tree module, two stored XSS vectors exist in the widget/formatter rendering pipeline. Vector A (token display templates): When the Token module is enabled and token display templates are configured, attacker-controlled token output (e.g., term descr...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.