CVE-2014-4303

low

Published 2014-06-18 · Modified 2026-05-06

CVSS v3

—

CVSS v2

2.1

VIR risk

2.1

Description

Multiple cross-site scripting (XSS) vulnerabilities in the Touch theme 7.x-1.x before 7.x-1.9 for Drupal allow remote authenticated users with the Administer themes permission to inject arbitrary web script or HTML via vectors related to the (1) Twitter and (2) Facebook username settings.

Predictions

Exploit likelihood

20%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: cve@mitre.org — https://drupal.org/node/2284415

vendor Authored 2026-05-27

Vendor advisory: cve@mitre.org — https://drupal.org/node/2269483

Application impact

Vendor	Product	Versions
drupac	touch	`7.x-1.0`
drupac	touch	`7.x-1.1`
drupac	touch	`7.x-1.2`
drupac	touch	`7.x-1.3`
drupac	touch	`7.x-1.4`
drupac	touch	`7.x-1.5`
drupac	touch	`7.x-1.6`
drupac	touch	`7.x-1.7`
drupac	touch	`7.x-1.8`

References

http://secunia.com/advisories/58828
http://www.securityfocus.com/bid/68045
https://drupal.org/node/2269483
https://drupal.org/node/2284415
http://secunia.com/advisories/58828
http://www.securityfocus.com/bid/68045
https://drupal.org/node/2269483
https://drupal.org/node/2284415

CWEs

CWE-79

Verify integrity in audit chain (admin only). AS-IS.