Cross-site scripting (XSS) vulnerability in the Webform module 6.x-3.x before 6.x-3.19 for Drupal allows remote authenticated users with the \edit own webform content\ or \edit all webform content\ permissions to inject arbitrary web script or HTML via a component label.