The Simple Hierarchical Select (shs) module for Drupal 7 contains a cross-site scripting vulnerability due to improper escaping of term-derived text in certain output contexts. Specifically, the vulnerability affects the field formatter output function (shs_field_formatter_view) and the term-tree child-term data generation function (shs_term_get_children). Maliciously crafted taxonomy term names can be rendered unsafely, potentially allowing script injection. Affected versions include 7.x-1.0 through 7.x-1.10. The CVSS 4.0 base score is 5.1, indicating medium severity. No patch or official fix has been documented in the provided data.

Successful exploitation of this vulnerability could allow an attacker with limited privileges to inject and execute arbitrary scripts in the context of users viewing affected taxonomy term outputs. This could lead to typical XSS impacts such as session hijacking, defacement, or redirection. However, the vulnerability requires user interaction and privileges to create malicious taxonomy terms. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider restricting permissions to create or edit taxonomy terms to trusted users only. Monitor Drupal security advisories for updates regarding patches or workarounds for this vulnerability.