Security Risk: 
Critical
Vulnerability: 
Cross Site Scripting
Affected Versions: 
  • 4.7.13 and earlier
  • 4.6.23 and earlier
Fixed Versions: 
  • 4.7.14
  • 4.6.24
Publication Date: 
Friday, December 2, 2016
Description: 

When displaying entity reference fields, the labels were not properly being escaped.

Solutions: 

Update to the latest version of CiviCRM

  • 4.6.24
  • 4.7.14

If you cannot upgrade apply the following patch https://github.com/civicrm/civicrm-core/pull/9482/files

Credits: 

Coleman Watts for raising the issue and providing a fix.

References: