Cross-Site Scripting Vulnerability in Bootstrap Lite Theme for Backdrop CMS
CVE-2025-27826

6.4MEDIUM

Key Information:

Vendor

Backdropcms

Status
Bootstrap Lite Theme
Vendor
CVE Published:
7 March 2025

What is CVE-2025-27826?

An XSS vulnerability was identified in the Bootstrap Lite theme used within Backdrop CMS, prior to version 1.x-1.4.5. This issue arises from inadequate sanitization of specific class names, which could allow an attacker to inject malicious scripts into web pages. Users should upgrade to the latest version to mitigate potential risks associated with web application attacks.

Affected Version(s)

Bootstrap Lite theme 0 < 1.x-1.4.5

References

https://backdropcms.org/security/backdrop-sa-core-2025-005

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-27826 : Cross-Site Scripting Vulnerability in Bootstrap Lite Theme for Backdrop CMS