Cross-site scripting (XSS) vulnerability in the Node Blocks module 5.x-1.1 and earlier and 6.x-1.3 and earlier a module for Drupal allows remote authenticated users with permissions to create or edit content and administer blocks to inject arbitrary web script or HTML via the edit-title parameter (aka block title).