Cross-site scripting (XSS) vulnerability in the additional links interface in XML Sitemap 5.x-1.6 a module for Drupal allows remote authenticated users with \administer site configuration\ permission to inject arbitrary web script or HTML via unspecified vectors related to link path output.