• Advisory ID: DRUPAL-SA-CONTRIB-2011-013
  • Project: Tagadelic (third-party module)
  • Version: 6.x
  • Date: 2011-March-16
  • Security risk: Moderately Critical (definition of risk levels)
  • Exploitable from: Remote
  • Vulnerability: Cross Site Scripting


Tagadelic module offers various ways to display terms and vocabularies in a tag cloud on a page or in a block. The module does not sanitize the taxonomy vocabulary names and descriptions when displayed on listing pages or blocks, leading to a Cross-Site Scripting (XSS) vulnerability that may lead to a malicious user gaining full administrative access.

This vulnerability is mitigated by the fact that the user must be able to create or edit taxonomy vocabularies, normally restricted by the "administer taxonomy" permission, in order to exploit it.

Versions affected

  • Tagadelic module 6.x-1.x versions prior to 6.x-1.3

Note: If you do not use the contributed Tagadelic module, there is nothing you need to do.


Install the latest version:

See also the Tagadelic project page.

Reported by

Fixed by

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the form at http://drupal.org/contact. Learn more about the team and their policies, writing secure code for Drupal, and secure configuration of your site.