CVE-2014-7980

LOW 3.5CVE-2014-7980 · Published 08/10/2014 · updated 17/06/2026

In short

CVE-2014-7980 is a LOW (CVSS 3.5) vulnerability affecting zen (drupal).
Chance of exploitation in the next 30 days (EPSS): 0.95%, higher than 61.1% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
zen drupal	`= 7.x-3.0= 7.x-3.1= 7.x-3.2= 7.x-5.0= 7.x-5.1= 7.x-5.2= 7.x-5.3= 7.x-5.4`	No fix yet

Description

Multiple cross-site scripting (XSS) vulnerabilities in template.php in Zen theme 7.x-3.x before 7.x-3.3 and 7.x-5.x before 7.x-5.5 for Drupal allow remote authenticated users with the "administer themes" permission to inject arbitrary web script or HTML via the skip_link_text setting and unspecified other theme settings.

References

drupal.org/node/2254925 · Patch
secunia.com/advisories/58318
securityfocus.com/bid/67175
drupal.org/node/2254835 · Patch
drupal.org/node/2254837 · Patch

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free