Cross-Site Scripting in Simple Hierarchical Select for Drupal 7 by Drupal

CVE-2026-4929

What is CVE-2026-4929?

The Simple Hierarchical Select (SHS) module for Drupal 7 is susceptible to cross-site scripting due to improper output escaping of term-derived text. This vulnerability allows malicious users to exploit taxonomy term names, which can be rendered unsafely based on the output context. Affected paths include the field formatter output and the generation of child-term data. This vulnerability impacts all versions from 7.x-1.0 up to and including 7.x-1.10.

References