CVE-2026-4929

Simple Hierarchical Select (SHS) for Drupal 7 contains cross-site scripting risk due to improper output escaping of term-derived text. Confirmed affected paths include field formatter output (shs_field_formatter_view) and term-tree child-term data generation (shs_term_get_children). Malicious taxonomy term names can be rendered unsafely depending on output context. This affects versions from 7.x-1.0 through (and including) 7.x-1.10.

• CWE-79

• https://d7es.tag1.com/security-advisories/simple-hierarchical-select-moderately-critical-cross-site-scriptingThird Party Advisory
• https://www.herodevs.com/vulnerability-directory/cve-2026-4929Exploit, Third Party Advisory
• https://www.herodevs.com/vulnerability-directory/cve-2026-4929?nes-for-drupal-7Exploit, Third Party Advisory

Published

May 21, 2026

Last Modified

Jul 23, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-49283The SimpleSAMLphp SAML2 library is a PHP library for SAML2 r…8.7
• CVE-2026-49284SimpleSAMLphp versions before 1.18.6 contain an information …7.1
• CVE-2026-49286PhpWeasyPrint is a PHP library allowing PDF generation from …8.1
• CVE-2026-49287Statamic is a Laravel and Git powered content management sys…7.4
• CVE-2026-49288Statamic is a Laravel and Git powered content management sys…4.3
• CVE-2026-49289The SimpleSAMLphp SAML2 library is a PHP library for SAML2 r…7.5
• CVE-2026-49290Slopsmith is a self-contained web application for browsing, …7.6
• CVE-2026-49291mcp-memory-service is a semantic memory layer for AI applica…8.1
• CVE-2026-49292Kiwi TCMS is an open source test management system. Prior to…0
• CVE-2026-49293js-toml is a TOML parser for JavaScript, fully compliant wit…7.5
• CVE-2026-49294Valhalla is an open source routing engine and accompanying l…6.1
• CVE-2026-49295libde265 is an open source implementation of the h.265 video…7.1