Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.1

Drupal7 sites with old jQuery UI can run unwanted scripts

published 1 month ago
Summary

Websites built with the Drupal7 package that include an outdated version of jQuery UI are vulnerable to a type of attack where a malicious user could insert and run their own code in a visitor’s browser. This could let an attacker steal information or change what the user sees. Update the jQuery UI component (or the Drupal7 package that bundles it) to the latest version to close the risk.

What to do
  • Update cleanstart drupal7 to version 7.86-r0.
Affected software
Ecosystem VendorProductAffected versions
CleanStart cleanstart drupal7 < 7.86-r0
Fix: upgrade to 7.86-r0
Original advisory text
Cross-site scripting (XSS) vulnerability in jQuery UI before 1
Security vulnerability affects the drupal7 package. Cross-site scripting (XSS) vulnerability in jQuery UI before 1.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
6.1 Medium
Timeline
Published1 Oct 2026
Updated1 Oct 2026
First seen1 Oct 2026
Sources
CLEANSTART-2024-EC59064 · OSV
Track software like this
Free during beta