VYPR
← All advisories
Unrated severityNVD Advisory· Published Apr 21, 2015· Updated Jun 17, 2026

CVE-2015-3357

CVE-2015-3357

Description

Cross-site scripting (XSS) vulnerability in the Wishlist module before 6.x-2.7 and 7.x-2.x before 7.x-2.7 for Drupal allows remote authenticated users with the "access wishlists" permission to inject arbitrary web script or HTML via unspecified vectors, which are not properly handled in a log message.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

6
  • WordPress/Wishlistinferred
    Range: <6.x-2.7,>=7.x-2.0,<7.x-2.7
    Package: https://wordpress.org/plugins/wishlist
  • Wishlist Project/Wishlist4 versions
    cpe:2.3:a:wishlist_project:wishlist:7.x-2.5:*:*:*:*:drupal:*:*+ 3 more
    • cpe:2.3:a:wishlist_project:wishlist:7.x-2.5:*:*:*:*:drupal:*:*
    • cpe:2.3:a:wishlist_project:wishlist:7.x-2.6:*:*:*:*:drupal:*:*
    • cpe:2.3:a:wishlist_project:wishlist:7.x-2.x-dev:*:*:*:*:drupal:*:*
    • cpe:2.3:a:wishlist_project:wishlist:*:*:*:*:*:drupal:*:*range: <=6.x-2.6
  • Drupal/Wishlistllm-create
    Range: <6.x-2.7, <7.x-2.7

Patches

Vulnerability mechanics

References

4

News mentions

0

No linked articles in our index yet.