Vulnerability Report

CVE-2014-7980

Title: Drupal Zen Cross-Site Scripting (XSS)

XSS

Proof Of Concept

No public PoC currently indexed for CVE-2014-7980.

CWE Category CWE-79

Published Date Oct 08, 2014

Modified Date May 06, 2026

Exploit Status Not Found

Score 3.5 CVSS v2.0

Exploit Probability (EPSS)

0.23%

Vulnerability Summary

CVE-2014-7980: Multiple cross-site scripting (XSS) vulnerabilities in template.php in Zen theme 7.x-3.x before 7.x-3.3 and 7.x-5.x before 7.x-5.5 for Drupal allow remote authenticated users with the "administer themes" permission to inject arbitrary web script or HTML via the skip_link_text setting and unspecified other theme settings.

Impacted Vendors

drupal 1

zen_project 1

Reference Links

http://drupal.org/node/2254925 http://secunia.com/advisories/58318 http://www.securityfocus.com/bid/67175 https://www.drupal.org/node/2254835 https://www.drupal.org/node/2254837 http://drupal.org/node/2254925 http://secunia.com/advisories/58318 http://www.securityfocus.com/bid/67175 https://www.drupal.org/node/2254835 https://www.drupal.org/node/2254837

CVSS v2.0

Source Entity [email protected]

Severity LOW

3.5

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:N/AC:M/Au:S/C:N/I:P/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2014-7980 Exploits & PoCs (Proof Of Concept)

No public PoCs found in our database for this CVE.

May 06, 2026 MODIFIED

Vulnerability data updated via NVD.

May 06, 2026 MODIFIED

Vulnerability data updated via NVD.

April 12, 2025 MODIFIED

Vulnerability data or affected products updated.

October 08, 2014 PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector N/A

Complexity N/A

Privileges N/A

Interaction NONE

CVSS Vector String


                                    AV:N/AC:M/Au:S/C:N/I:P/A:N

Affected Stack

No specific products linked.