Still on Drupal 7? Security support for Drupal 7 ended on 5 January 2025. Please visit our Drupal 7 End of Life resources page to review all of your options.
See SA-CONTRIB-2012-078 - Smart Breadcrumb - Cross Site Scripting (XSS).
Fixing XSS vulnerability reported by coltrane:
The function filter_titles() incorrectly attempts to set a title to plain-text, but is only using Drupal's t() function which does not run any sanitization.