CVE-2026-4093
Stored XSS in Drupal 7 Term Reference Tree module (token display templates and term labels)
Description
In the Drupal 7 Term Reference Tree module, two stored XSS vectors exist in the widget/formatter rendering pipeline. Vector A (token display templates): When the Token module is enabled and token display templates are configured, attacker-controlled token output (e.g., term description) is rendered without proper sanitization. Any user who can edit the referenced taxonomy terms can inject HTML/JS that executes when the field is rendered. Vector B (term label rendering): Taxonomy term labels are not properly sanitized before being rendered in the widget, allowing a user with permission to create or edit taxonomy terms to inject scripts into the term name that execute when a form containing the widget is viewed. Exploit affects versions 7.x-1.x up to and including 7.x-1.11.
INFO
Published Date :
May 21, 2026, 10:16 p.m.
Last Modified :
July 23, 2026, 4:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
Affected Products
The following products are affected by CVE-2026-4093
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | MEDIUM | [email protected] | ||||
| CVSS 4.0 | MEDIUM | 2c85b837-eb8b-40ed-9d74-228c62987387 | ||||
| CVSS 4.0 | MEDIUM | [email protected] |
Solution
- Update the Term Reference Tree module to version 7.x-1.12 or later.
- Review and sanitize existing taxonomy term labels and descriptions.
- Ensure proper input sanitization for user-generated content.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-4093.
| URL | Resource |
|---|---|
| https://d7es.tag1.com/security-advisories/taxonomy-term-reference-tree-widget-moderately-critical-cross-site-scripting | Third Party Advisory |
| https://www.herodevs.com/vulnerability-directory/cve-2026-4093 | Exploit Third Party Advisory |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-4093 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-4093
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-4093 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-4093 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Jul. 23, 2026
Action Type Old Value New Value Added Translation Title: Term Reference Tree de Drupal, Description: En el módulo Drupal 7 Term Reference Tree, existen dos vectores de XSS almacenado en la cadena de renderizado de widgets/formatters. Vector A (plantillas de visualización de tokens): Cuando el módulo Token está habilitado y las plantillas de visualización de tokens están configuradas, la salida de token controlada por el atacante (p. ej., descripción del término) se renderiza sin la sanitización adecuada. Cualquier usuario que pueda editar los términos de taxonomía referenciados puede inyectar HTML/JS que se ejecuta cuando se renderiza el campo. Vector B (renderizado de etiquetas de término): Las etiquetas de los términos de taxonomía no se sanitizan correctamente antes de ser renderizadas en el widget, lo que permite a un usuario con permiso para crear o editar términos de taxonomía inyectar scripts en el nombre del término que se ejecutan cuando se visualiza un formulario que contiene el widget. El exploit afecta a las versiones 7.x-1.x hasta la 7.x-1.11 inclusive. -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.drupalcode.org/project/term_reference_tree', 'vendor': 'Drupal', 'product': 'Term Reference Tree', 'versions': [{'status': 'affected', 'version': '7.x-1.x', 'versionType': 'custom', 'lessThanOrEqual': '7.x-1.11'}], 'packageName': 'Term Reference Tree', 'collectionURL': 'https://www.drupal.org/project/term_reference_tree', 'defaultStatus': 'unaffected'}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-4093', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-05-22T13:23:03.434925Z'} -
Initial Analysis by [email protected]
Jun. 01, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Added CPE Configuration OR *cpe:2.3:a:taxonomy_term_reference_tree_widget_project:taxonomy_term_reference_tree_widget:*:*:*:*:*:drupal:*:* versions from (including) 7.x-1.0 up to (excluding) 7.x-1.12 Added Reference Type Drupal.org: https://d7es.tag1.com/security-advisories/taxonomy-term-reference-tree-widget-moderately-critical-cross-site-scripting Types: Third Party Advisory Added Reference Type Drupal.org: https://www.herodevs.com/vulnerability-directory/cve-2026-4093 Types: Exploit, Third Party Advisory -
New CVE Received by [email protected]
May. 21, 2026
Action Type Old Value New Value Added Description In the Drupal 7 Term Reference Tree module, two stored XSS vectors exist in the widget/formatter rendering pipeline. Vector A (token display templates): When the Token module is enabled and token display templates are configured, attacker-controlled token output (e.g., term description) is rendered without proper sanitization. Any user who can edit the referenced taxonomy terms can inject HTML/JS that executes when the field is rendered. Vector B (term label rendering): Taxonomy term labels are not properly sanitized before being rendered in the widget, allowing a user with permission to create or edit taxonomy terms to inject scripts into the term name that execute when a form containing the widget is viewed. Exploit affects versions 7.x-1.x up to and including 7.x-1.11. Added CVSS V4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-79 Added Reference https://d7es.tag1.com/security-advisories/taxonomy-term-reference-tree-widget-moderately-critical-cross-site-scripting Added Reference https://www.herodevs.com/vulnerability-directory/cve-2026-4093