Cross-Site Scripting Vulnerability in Drupal Simple Multi Step Form

CVE-2025-12761

What is CVE-2025-12761?

The vulnerability in the Simple multi step form plugin for Drupal arises from improper sanitization of user input during web page generation. This allows an attacker to inject malicious scripts that can be executed in the context of a user's browser, potentially compromising sensitive information or hijacking user sessions. Affected versions include all before 2.0.0, underscoring the importance of updating to the latest secured release.

References