Vulnerability · Published May 21, 2026 · Assigned by drupal
CVE-2026-4093Stored XSS in Drupal 7 Term Reference Tree module (token display templates and term labels)
Medium 5.1
In plain English
A medium-severity cross-site scripting in Term Reference Tree from Drupal. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).
Official description
In the Drupal 7 Term Reference Tree module, two stored XSS vectors exist in the widget/formatter rendering pipeline. Vector A (token display templates): When the Token module is enabled and token display templates are configured, attacker-controlled token output (e.g., term description) is rendered without proper sanitization. Any user who can edit the referenced taxonomy terms can inject HTML/JS that executes when the field is rendered. Vector B (term label rendering): Taxonomy term labels are not properly sanitized before being rendered in the widget, allowing a user with permission to create or edit taxonomy terms to inject scripts into the term name that execute when a form containing the widget is viewed. Exploit affects versions 7.x-1.x up to and including 7.x-1.11.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Drupal | Term Reference Tree | 7.x-1.x – through 7.x-1.11 |
Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N