PT-2026-42578 · Drupal · Term Reference Tree

Ra Mänd + 1 · Published 2026-05-21 · Updated 2026-05-22 · CVE-2026-4093

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Drupal 7 Term Reference Tree versions 7.x-1.x through 7.x-1.11

Description Two stored Cross-Site Scripting (XSS) vectors exist in the widget/formatter rendering pipeline. The first vector occurs when the Token module is enabled and token display templates are configured, causing attacker-controlled token output, such as term descriptions, to be rendered without proper sanitization. This allows users capable of editing referenced taxonomy terms to inject HTML or JavaScript. The second vector involves taxonomy term labels that are not properly sanitized before being rendered in the widget, enabling users with permissions to create or edit taxonomy terms to inject scripts into the term name that execute when a form containing the widget is viewed.

Recommendations Update Drupal 7 Term Reference Tree to a version later than 7.x-1.11.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-4093

Affected Products

Term Reference Tree

References · 5

• 🔥 https://herodevs.com/vulnerability-directory/cve-2026-4093 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-4093 · Security Note
• https://d7es.tag1.com/security-advisories/taxonomy-term-reference-tree-widget-moderately-critical-cross-site-scripting · Note
• https://twitter.com/CVEnew/status/2057783190870241424 · Twitter Post
• https://t.me/cveNotify/164475 · Telegram Post