CVE-2013-2129: Nathan Haug Webform

Medium severity, CVSS 4.3. EPSS: 1.3% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in the Webform module 6.x-3.x before 6.x-3.19 for Drupal allows remote authenticated users with the "edit own webform content" or "edit all webform content" permissions to inject arbitrary web script or HTML via a component label.

Affected products

• Nathan Haug Webform: up to and including 6.x-3.18; version 6.x-3.0 only; version 6.x-3.1 only; version 6.x-3.2 only; version 6.x-3.3 only; version 6.x-3.4 only; …

Published 2013-06-24. Last modified 2026-06-16.