Gdpr Cookies Module For Backdrop Cms
Monthly
Stored Cross-Site Scripting in the GDPR Cookies module for Backdrop CMS (versions before 1.x-1.3.5) allows a privileged authenticated attacker to inject malicious script via the optional 'Info content' field of a YouTube service configuration, executing arbitrary JavaScript in the browsers of site visitors who interact with the GDPR cookie consent widget. Exploitation is heavily gated: the attacker must hold a CMS role with 'Create a GDPR Cookies Service' or 'Edit any GDPR Cookies Service' permission, and the site must have an active YouTube service configured. No public exploit exists and no active exploitation has been confirmed; EPSS is 0.04% at the 13th percentile, consistent with SSVC's 'exploitation: none' finding.
Stored Cross-Site Scripting in the GDPR Cookies module for Backdrop CMS (versions before 1.x-1.3.5) allows a privileged authenticated attacker to inject malicious script via the optional 'Info content' field of a YouTube service configuration, executing arbitrary JavaScript in the browsers of site visitors who interact with the GDPR cookie consent widget. Exploitation is heavily gated: the attacker must hold a CMS role with 'Create a GDPR Cookies Service' or 'Edit any GDPR Cookies Service' permission, and the site must have an active YouTube service configured. No public exploit exists and no active exploitation has been confirmed; EPSS is 0.04% at the 13th percentile, consistent with SSVC's 'exploitation: none' finding.