Drupal released an update that patches a moderately critical cross-site scripting vulnerability in its Mollom content and spam moderation module.