Drupal Creative Theme third party theme version 7.x suffers from a cross site scripting vulnerability.