https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2015-4374.htmlhttps://patchthecve.com/cve/CVE-2015-4374.htmlWed, 17 Jun 2026 00:27:11 +0000LOW 3.5: Cross-site scripting (XSS) vulnerability in the Webform module before 6.x-3.23, 7.x-3.x before 7.x-3.23, and 7.x-4.x before 7.x-4.5 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a component name in the recipient (To) address of an emhttps://patchthecve.com/cve/CVE-2015-4357.htmlhttps://patchthecve.com/cve/CVE-2015-4357.htmlWed, 17 Jun 2026 00:27:09 +0000LOW 3.5: Cross-site scripting (XSS) vulnerability in the Webform module before 6.x-3.22, 7.x-3.x before 7.x-3.22, and 7.x-4.x before 7.x-4.4 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a node title, which is used as the default title of a whttps://patchthecve.com/cve/CVE-2015-4356.htmlhttps://patchthecve.com/cve/CVE-2015-4356.htmlWed, 17 Jun 2026 00:27:09 +0000LOW 3.5: Cross-site scripting (XSS) vulnerability in the view-based webform results table in the Webform module 7.x-4.x before 7.x-4.4 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a webform.https://patchthecve.com/cve/CVE-2014-8318.htmlhttps://patchthecve.com/cve/CVE-2014-8318.htmlWed, 17 Jun 2026 00:16:32 +0000LOW 3.5: Cross-site scripting (XSS) vulnerability in the Webform module 6.x-3.x before 6.x-3.20, 7.x-3.x before 7.x-3.20, and 7.x-4.x before 7.x-4.0-beta2 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a field label title, when two fields havehttps://patchthecve.com/cve/CVE-2013-2129.htmlhttps://patchthecve.com/cve/CVE-2013-2129.htmlTue, 16 Jun 2026 23:52:48 +0000MEDIUM 4.3: Cross-site scripting (XSS) vulnerability in the Webform module 6.x-3.x before 6.x-3.19 for Drupal allows remote authenticated users with the "edit own webform content" or "edit all webform content" permissions to inject arbitrary web script or HTML via a component label.https://patchthecve.com/cve/CVE-2012-1660.htmlhttps://patchthecve.com/cve/CVE-2012-1660.htmlTue, 16 Jun 2026 23:40:02 +0000LOW 2.1: Multiple cross-site scripting (XSS) vulnerabilities in components/select.inc in the Webform module 6.x-3.x before 6.x-3.17 and 7.x-3.x before 7.x-3.17 for Drupal, when the "Select (or other)" module is enabled, allow remote authenticated users with the create webform content permission to inject arb