Drupal Flag third party module version 7.x suffers from a cross site scripting vulnerability…. Drupal Flag third party module version 7.x suffers from a cross site scripting vulnerability.
Read more http://packetstormsecurity.com/files/122991/DRUPAL-SA-CONTRIB-2013-071.txt