EUVD-2025-18288Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Lifecycle Timeline
4DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal COOKiES Consent Management allows Cross-Site Scripting (XSS).This issue affects COOKiES Consent Management: from 0.0.0 before 1.2.15.
AnalysisAI
Cross-Site Scripting (XSS) vulnerability in Drupal's COOKiES Consent Management module that allows unauthenticated remote attackers to inject and execute malicious scripts during web page generation. All versions from 0.0.0 before 1.2.15 are affected. The vulnerability has a high CVSS score of 8.6 with no authentication or user interaction required, enabling attackers to compromise confidentiality, modify page content, and degrade availability. The network-based attack vector and low complexity indicate this is likely actively exploitable in real-world deployments.
Technical ContextAI
The vulnerability exists in the Drupal COOKiES Consent Management module (CPE: cpe:2.3:a:drupal:cookies_consent_management:*), which is a web-based cookie consent banner and management solution for Drupal-based websites. The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic XSS vulnerability where user-controlled input or configuration data is rendered into HTML/JavaScript without proper sanitization or output encoding. In the context of a cookie consent management tool, this likely involves inadequate escaping of cookie policy text, consent messages, or configuration parameters that are reflected in the dynamically generated consent banner. The module operates within Drupal's rendering pipeline, where content should be properly sanitized using Drupal's XHTML filter or equivalent functions before output. The failure to do so allows attackers to bypass the cookie consent interface entirely and inject arbitrary client-side code.
RemediationAI
Immediate Patch: Upgrade Drupal COOKiES Consent Management module to version 1.2.15 or later; priority: CRITICAL; method: Use Drupal's module update system (Manage > Extend > Update or via Composer: composer update drupal/cookies_consent_management) Verification: After patching, verify the module version: drush pm-info cookies_consent_management or check /admin/modules; priority: HIGH Interim Mitigation (if patching delayed): Disable the COOKiES Consent Management module temporarily via /admin/modules if the delay in patching is necessary; this removes the attack surface entirely; priority: MEDIUM Input Validation Review: If operating a custom fork or extension, audit all cookie policy text, consent message fields, and configuration parameters to ensure they are properly sanitized using Drupal's sanitizer functions (e.g., Xss::filter(), htmlspecialchars() with ENT_QUOTES, or Drupal's render array #plain_text property); priority: HIGH WAF/Content Security Policy: Implement or strengthen Content Security Policy (CSP) headers to restrict inline script execution and limit XSS blast radius, even if exploitation occurs; priority: MEDIUM
More from same product – last 7 days
Authentication bypass in Discuz! X5.0 releases 20260320 through 20260501 allows unauthenticated remote attackers to acce
Authenticated remote code execution in Discuz! X5.0 releases 20260320 through 20260501 allows administrators to chain a
Unauthenticated PHP Object Injection in the Happyforms WordPress plugin (versions <= 1.26.13) allows remote attackers to
Unauthenticated PHP Object Injection in the Broadcast Live Video WordPress plugin (versions prior to 7.1.3) allows remot
Unauthenticated PHP object injection in the WordPress plugin 'Integration for Keap/Infusionsoft and Contact Form 7, WPFo
Share
External POC / Exploit Code
Leaving vuln.today