Safedelete
Monthly
Stored cross-site scripting in the Drupal SafeDelete contributed module (versions 0.0.0 through 1.0.88) allows a low-privileged authenticated user to persist malicious markup that executes in the browser of a second user - typically an administrator or content reviewer - who later loads the page where the unneutralized input is rendered. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) rates this 4.6, a moderate severity: exploitation requires an authenticated account able to write into the affected SafeDelete field plus victim interaction, which meaningfully lowers real-world risk below what the network vector alone suggests. No public exploit code has been identified at time of analysis and EPSS is 0.16% (5th percentile); the vendor has published a security advisory and a fix is available.
Stored cross-site scripting in the Drupal SafeDelete contributed module (versions 0.0.0 through 1.0.88) allows a low-privileged authenticated user to persist malicious markup that executes in the browser of a second user - typically an administrator or content reviewer - who later loads the page where the unneutralized input is rendered. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) rates this 4.6, a moderate severity: exploitation requires an authenticated account able to write into the affected SafeDelete field plus victim interaction, which meaningfully lowers real-world risk below what the network vector alone suggests. No public exploit code has been identified at time of analysis and EPSS is 0.16% (5th percentile); the vendor has published a security advisory and a fix is available.