XSS

Drupal site security gets a boost from simplicity with the Security Kit (SecKit) module. Published by ImageX, the guide walks users through configuring browser-layer defenses like XSS, CSRF, and clickjacking protection without touching code. SecKit makes advanced policies accessible to site admins with intuitive settings that help prevent client-side attacks. ...more

Jess (xjm) details the handling of “Anemone,” a Drupal core XSS vulnerability fixed in SA-CORE-2025-004. Learn how the Security Team balanced ecosystem impact, sanitized APIs, and coordinated with contrib maintainers. ...more

Drupal has issued security updates to fix critical and moderately critical vulnerabilities, including a cross-site scripting flaw, access bypass risks, and a PHP object injection issue. Administrators are urged to update their systems immediately to protect against potential exploits. ...more

The Drupal Security Team announced on March 9th, 2022 a critical cross site scripting (XSS) error in SVG Formatter SA-CONTRIB-20220-028. ...more

The Drupal Security Team announced on February 23rd 2022, a moderately critical Cross-Site Scripting (XSS) vulnerability in the Entity Reference Tree Widget module SA-CONTRIB-2022-026. ...more

Drupal Security Team announced a Cross-Site Scripting (XSS) vulnerability SA-CONTRIB-2022-024 that has low criticality index in the Custom Breadcrumbs Module on February 9th, 2022. ...more

The Drupal Security Team announced a moderately critical Cross-site Scripting-SA-CONTRIB-2022-011 Vulnerability in Navbar module in Drupal 7on January 25th, 2022. ...more