The Simple Hierarchical Select module for Drupal 7 contains a cross‑site scripting vulnerability caused by failing to escape taxonomy term names before rendering them. This flaw occurs when the module outputs term‑derived data in the field formatter view or during child‑term generation, allowing arbitrary HTML or JavaScript to be displayed to users who view the affected content.

Drupal 7 sites that use the Simple Hierarchical Select module from versions 7.x‑1.0 through 7.x‑1.10 are affected. The vulnerability applies to any installation where taxonomy term data rendered by the module is accessible to users.

The CVSS score of 5.1 signifies a medium severity issue, and no EPSS value is available. The vulnerability is not listed in the CISA KEV catalog. An attacker can create a malicious taxonomy term via the web interface or API and, when it is rendered by the module, will execute script code in the browsers of any user who views that content. Exploitation is remote, requires no local privileges, and is confined to the application context.