What’s Vulnerable › Vulnerabilities

CVE-2018-7603: Search Autocomplete

• Severity: medium (CVSS 6.1 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-01-15 · updated 2026-06-17
• Weakness: CWE-79

Description

In Drupal's 3rd party module search auto complete prior to versions 7.x-4.8 there is a Cross Site Scripting vulnerability. This Search Autocomplete module enables you to autocomplete textfield using data from your website (nodes, comments, etc.). The module doesn't sufficiently filter user-entered text among the autocompletion items leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability can be exploited by any user allowed to create one of the autocompletion item, for instance, nodes, users, comments.

Affected products

• Drupal 3rd party module - Search Autocomplete: before 7.x-4.8 — fixed in 7.x-4.8

How to fix

Upgrade to a fixed version: Drupal 3rd party module - Search Autocomplete 7.x-4.8. Check the vendor advisory for mitigations.

References

• https://www.drupal.org/sa-contrib-2018-070
• https://www.drupal.org/sa-contrib-2018-070

Get alerted when CVE-2018-7603 or the next vulnerability affects your stack