What is the CVSS score of CVE-2025-48915?

CVE-2025-48915 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2025-48915?

A cross-site scripting (XSS) vulnerability in Drupal's COOKiES Consent Management module allows attackers to inject malicious scripts that could compromise user sessions, steal credentials, or…. A patch is available.

How to fix or mitigate CVE-2025-48915?

Within 24 hours: Inventory all Drupal installations using COOKiES Consent Management and identify current versions; disable the module if not critical to operations. Within 7 days: Implement WAF rules to block XSS payloads targeting the module; apply input validation on cookie consent forms; restrict administrative access to the module. Within 30 days: Monitor vendor release cycles and apply patch immediately upon availability; conduct security audit of affected systems for signs of exploitation.

PHP CVE-2025-48915

EUVD-2025-18288 HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-06-13 mlhess@drupal.org

XSS Drupal PHP Cookies Consent Management

8.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 14, 2026 - 21:34 euvd

EUVD-2025-18288

Analysis Generated

Mar 14, 2026 - 21:34 vuln.today

CVE Published

Jun 13, 2025 - 16:15 nvd

HIGH 8.6

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal COOKiES Consent Management allows Cross-Site Scripting (XSS).This issue affects COOKiES Consent Management: from 0.0.0 before 1.2.15.

AnalysisAI

Cross-Site Scripting (XSS) vulnerability in Drupal's COOKiES Consent Management module that allows unauthenticated remote attackers to inject and execute malicious scripts during web page generation. All versions from 0.0.0 before 1.2.15 are affected. The vulnerability has a high CVSS score of 8.6 with no authentication or user interaction required, enabling attackers to compromise confidentiality, modify page content, and degrade availability. The network-based attack vector and low complexity indicate this is likely actively exploitable in real-world deployments.

Technical ContextAI

The vulnerability exists in the Drupal COOKiES Consent Management module (CPE: cpe:2.3:a:drupal:cookies_consent_management:*), which is a web-based cookie consent banner and management solution for Drupal-based websites. The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic XSS vulnerability where user-controlled input or configuration data is rendered into HTML/JavaScript without proper sanitization or output encoding. In the context of a cookie consent management tool, this likely involves inadequate escaping of cookie policy text, consent messages, or configuration parameters that are reflected in the dynamically generated consent banner. The module operates within Drupal's rendering pipeline, where content should be properly sanitized using Drupal's XHTML filter or equivalent functions before output. The failure to do so allows attackers to bypass the cookie consent interface entirely and inject arbitrary client-side code.

RemediationAI

Immediate Patch: Upgrade Drupal COOKiES Consent Management module to version 1.2.15 or later; priority: CRITICAL; method: Use Drupal's module update system (Manage > Extend > Update or via Composer: composer update drupal/cookies_consent_management) Verification: After patching, verify the module version: drush pm-info cookies_consent_management or check /admin/modules; priority: HIGH Interim Mitigation (if patching delayed): Disable the COOKiES Consent Management module temporarily via /admin/modules if the delay in patching is necessary; this removes the attack surface entirely; priority: MEDIUM Input Validation Review: If operating a custom fork or extension, audit all cookie policy text, consent message fields, and configuration parameters to ensure they are properly sanitized using Drupal's sanitizer functions (e.g., Xss::filter(), htmlspecialchars() with ENT_QUOTES, or Drupal's render array #plain_text property); priority: HIGH WAF/Content Security Policy: Implement or strengthen Content Security Policy (CSP) headers to restrict inline script execution and limit XSS blast radius, even if exploitation occurs; priority: MEDIUM