CVE-2026-4093
Description
In the Drupal 7 Term Reference Tree module, two stored XSS vectors exist in the widget/formatter rendering pipeline. Vector A (token display templates): When the Token module is enabled and token display templates are configured, attacker-controlled token output (e.g., term description) is rendered without proper sanitization. Any user who can edit the referenced taxonomy terms can inject HTML/JS that executes when the field is rendered. Vector B (term label rendering): Taxonomy term labels are not properly sanitized before being rendered in the widget, allowing a user with permission to create or edit taxonomy terms to inject scripts into the term name that execute when a form containing the widget is viewed. Exploit affects versions 7.x-1.x up to and including 7.x-1.11.
How to fix
- taxonomy_term_reference_tree_widget_project taxonomy_term_reference_tree_widget7.x-1.12 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| taxonomy_term_reference_tree_widget_project taxonomy_term_reference_tree_widget | 7.x-1.0 ≤ v < 7.x-1.12 | 7.x-1.12 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.