What is the CVSS score of CVE-2025-48914?

CVE-2025-48914 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2025-48914?

A Cross-Site Scripting (XSS) vulnerability in the Drupal COOKiES Consent Management module (versions before 1.2.15) allows attackers to inject malicious scripts that execute in users' browsers,…. A patch is available.

How to fix or mitigate CVE-2025-48914?

Within 24 hours: Identify all instances of COOKiES Consent Management module across the organization and document current versions; assess whether the module handles sensitive data. Within 7 days: Implement WAF rules to block XSS payloads targeting the vulnerable module, restrict administrative access to cookie consent settings, and disable the module if non-critical pending patch availability. Within 30 days: Monitor vendor channels for patch release (1.2.15 or later); conduct security review of any user-supplied input processed by the module; test and deploy patch immediately upon availability.

PHP CVE-2025-48914

EUVD-2025-18289 HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-06-13 mlhess@drupal.org

XSS Drupal PHP Cookies Consent Management

8.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 14, 2026 - 21:34 euvd

EUVD-2025-18289

Analysis Generated

Mar 14, 2026 - 21:34 vuln.today

CVE Published

Jun 13, 2025 - 16:15 nvd

HIGH 8.6

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal COOKiES Consent Management allows Cross-Site Scripting (XSS).This issue affects COOKiES Consent Management: from 0.0.0 before 1.2.15.

AnalysisAI

Stored/Reflected Cross-Site Scripting (XSS) vulnerability in Drupal's COOKiES Consent Management module (versions before 1.2.15) that allows unauthenticated attackers to inject malicious scripts into web pages due to improper input neutralization. The vulnerability has a CVSS score of 8.6 (High severity) with network-based attack vector requiring no privileges or user interaction, enabling attackers to compromise confidentiality, integrity, and availability of affected sites. No active KEV or widespread public PoC data is available in standard vulnerability databases, suggesting limited real-world exploitation at time of analysis, though the high CVSS and ease of exploitation (AV:N/AC:L/PR:N/UI:N) warrant immediate patching.

Technical ContextAI

The vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic XSS flaw where user-supplied input is rendered directly into HTML/JavaScript contexts without sanitization or encoding. The Drupal COOKiES Consent Management module (CPE: drupal:cookies_consent_management) fails to properly escape or filter input before displaying it in dynamically generated web pages, likely within cookie consent banner templates, configuration forms, or consent tracking mechanisms. Drupal modules leverage the Drupal Form API and theme rendering system; the flaw likely occurs in hook implementations (hook_form_alter, hook_preprocess_*, or custom theme functions) where user data from cookie consent settings, banner text customization, or tracking parameters is passed to render arrays without using proper Drupal sanitization functions (e.g., Html::escape(), Xss::filter()) or Twig autoescaping.

RemediationAI

Immediate actions: (1) Update Drupal COOKiES Consent Management module to version 1.2.15 or later, which includes input neutralization fixes; (2) If immediate patching is impossible, disable the module temporarily or restrict access to configuration forms using Drupal permissions (limit to trusted administrators only); (3) Review and sanitize any existing user-provided data in the module's database (cookie settings, custom banner text) using Drupal's database sanitization tools; (4) Implement Web Application Firewall (WAF) rules to detect and block XSS patterns in parameters known to be processed by the module (e.g., consent banner text, tracking parameters); (5) Enable Drupal's Security Review module to identify additional input handling vulnerabilities; (6) Apply Drupal security best practices: use Twig autoescaping, leverage Form API's built-in sanitization, and conduct code review of any custom hooks or theme overrides. Patch deployment should be prioritized within 48 hours given the ease of exploitation.