Description
The Nodequeue module allows administrators to create ordered queues of nodes that can be used to arrange and display site content.
The function that renders the admin subqueue listing passes subqueue titles through the title-substitution helper and places the result directly into a table cell data value without plain-text encoding, so any HTML or JavaScript characters in the title are rendered unescaped by the browser.
This vulnerability is mitigated by the fact that directly setting a malicious subqueue title requires the "administer nodequeue" permission; however, when the Smartqueue sub-module is enabled, subqueue titles are derived from taxonomy term names, so any user with permission to manage terms in a vocabulary linked to a smartqueue can inject the payload without nodequeue-level access.
Solution
Install the latest version.
If you use the Nodequeue module for Drupal 7, upgrade to Nodequeue 7.x-2.6:
Reported by
Fixed by
- Tag1 D7ES
Coordinated by
- Tag1 D7ES