Vulnerability Directory | CVE-2026-4929 | Drupal 7

Overview

Drupal is an open-source content management system known for its flexibility, robust features, and strong community support. Organizations of all sizes use it to build and manage dynamic websites and web applications.

The Simple Hierarchical Select module adds a taxonomy-term widget that lets users choose terms by browsing the vocabulary hierarchy.

SHS contains a cross-site scripting (XSS) weakness that can allow malicious markup in term labels to be rendered in the term tree or field output, potentially executing in a user’s browser.

A cross-site scripting (XSS) vulnerability is a type of security flaw that allows attackers to inject malicious scripts into webpages. It often occurs when a site fails to properly validate or sanitize user input, enabling the execution of unauthorized code within a victim's browser. It is included in the OWASP Top Ten list of vulnerabilities, specifically in the third category of Injection. A web site compromised in this way may experience:

Session hijacking
Data theft
Malware distribution
Defacement or phishing and
Privilege escalation.

This issue affects Simple Hierarchical Select versions 7.1.0 up to and including 7.1.11.

‍

Details

Module Info

Product: Drupal
Affected code: Simple Hierarchical Select module
Affected versions:
Project page: https://www.drupal.org/project/shs
Fixed in: Simple Hierarchical Select NES 7.1.11

Vulnerability Info

There is one underlying issue: unescaped output of term-derived text.

In affected SHS versions, this appears in two confirmed paths:

Field formatter output (shs_field_formatter_view) where term names could be rendered without escaping.
Term-tree data output (shs_term_get_children) where term names could be returned without escaping.

This can expose malicious markup in rendered output and may lead to XSS when inserted into unsafe HTML contexts.

These vulnerabilities affect SHS versions after 7.1.0 and are fixed in NES SHS 7.1.11.

‍

Addressing the Issues

Users of the affected components should apply one of the following:

Disable SHS entirely and switch affected fields back to core taxonomy widgets/formatters.
Add strict output escaping in theme/preprocess overrides for any SHS-rendered term labels (check_plain()/filter_xss_admin-safe patterns as appropriate).
Add term-name sanitization on save (hook_taxonomy_term_presave / hook_entity_presave) to reject or strip markup-like input.
Restrict taxonomy term create/edit permissions to trusted roles only.
Add WAF rules to detect/block obvious script payload patterns in taxonomy-related requests.
Increase logging/alerting for taxonomy term edits and unusual SHS endpoint traffic.
Sign up for post-EOL security support; HeroDevs customers get immediate access to a patched version of this module.