Security update

See SA-CONTRIB-2015-080 - Profile2 Privacy - Cross Site Scripting (XSS)

This release of 7.x-4.x fixes one security issues and a number of bugs. Updating is strongly recommended for all users of the 7.x-4.x branch. See SA-CONTRIB-2015-078 - Webform - Cross Site Scripting (XSS) for details.

Security issue

When a webform component is used as the "To" address or addresses for sending an e-mail, the name of the component is not sufficiently sanitized when it is displayed in the list of e-mail settings, leading to a Cross Site Scripting (XSS) vulnerability.

This release of 7.x-3.x fixes one security issue and a number of bugs. Updating is strongly recommended for all users of the webform 7.x-3.x branch.
See SA-CONTRIB-2015-078 - Webform - Cross Site Scripting (XSS) for details.

This release of 6.x-3.x fixes one security issue. Updating is strongly recommended for all Drupal 6 webform users.
See SA-CONTRIB-2015-078 - Webform - Cross Site Scripting (XSS) for details.

Security issue

When a webform component is used as the "To" address or addresses for sending an e-mail, the name of the component is not sufficiently sanitized when it is displayed in the list of e-mail settings, leading to a Cross Site Scripting (XSS) vulnerability.

Issue #2450135 by FatherShawn: Fix SA-CONTRIB-2015-066 - Tracking Code - Cross Site Request Forgery (CSRF)

Issue #2449747 by andrechun, xtfer: Fixes SA-CONTRIB-2015-068 - Campaign Monitor - Cross Site Request Forgery (CSRF)