GDPR Cookies Module CVE-2025-71310

Two explicit non-default conditions must both be true for exploitation to be possible: (1) the attacker must control a Backdrop CMS account assigned a role with either the 'Create a GDPR Cookies Service' or 'Edit any GDPR Cookies Service' permission - these are privileged, application-level roles not granted to standard authenticated users or anonymous visitors; and (2) the target Backdrop CMS installation must have a YouTube service actively configured within the GDPR Cookies module settings. Without both conditions, the vulnerable code path cannot be reached. Additionally, a real victim site visitor must actively interact with the GDPR cookie consent widget (UI:A) for the stored XSS payload to execute - automated mass exploitation is not feasible (SSVC: Automatable: no). The limiting factors are: insider or account-compromise scenario for the attacker, non-default YouTube service configuration for the site, and passive victim presence for payload delivery.

All available signals converge on very low real-world risk. The CVSS 4.0 score of 1.8 reflects the compounding effect of PR:H (high privileges required), AC:H (high attack complexity), AT:P (attack preconditions present - YouTube service must be configured), and UI:A (active victim interaction required). Impact is limited to integrity and availability at the subsequent-system level only (SI:L, SA:L), with no confidentiality impact. EPSS stands at 0.04% at the 13th percentile, indicating the overwhelming majority of CVEs are considered more likely to be exploited. SSVC confirms exploitation status as 'none' and automatable as 'no', meaning no scripted or opportunistic campaign is feasible given the preconditions. No CISA KEV listing and no POC code are identified. The dual exploitation gate - a privileged CMS role AND an active YouTube service configuration - means the realistic attacker pool is extremely narrow, limited to insider or compromised privileged accounts. This is a genuine low-priority finding with negligible environmental risk for most deployments.

An authenticated CMS editor with the 'Edit any GDPR Cookies Service' role permission navigates to the GDPR cookie administration panel and injects a JavaScript payload (e.g., a session-cookie harvester) into the 'Info content' field of an existing YouTube service entry and saves the configuration. When subsequent site visitors load a page displaying the GDPR cookie consent widget, the stored payload executes in their browser, potentially exfiltrating session tokens or performing DOM manipulation on their behalf. No public exploit code has been identified for this vulnerability.