Cross-Site Scripting Vulnerability in Drupal Core
CVE-2025-31675

5.4MEDIUM

Key Information:

Vendor
Drupal
Status
Drupal Core
Vendor
CVE Published:
31 March 2025

Summary

A Cross-Site Scripting (XSS) vulnerability exists in the Drupal core, allowing malicious users to inject arbitrary scripts into web pages. This vulnerability particularly affects versions of the Drupal core from 8.0.0 up to, but not including, 10.3.14; from 10.4.0 up to, but not including, 10.4.5; from 11.0.0 up to, but not including, 11.0.13; and from 11.1.0 up to, but not including, 11.1.5. Successful exploitation could enable attackers to execute unauthorized scripts in the content of the website, potentially compromising user data or performing actions on behalf of the user without their consent.

Affected Version(s)

Drupal core 8.0.0 < 10.3.14

Drupal core 10.4.0 < 10.4.5

Drupal core 11.0.0 < 11.0.13

References

https://www.drupal.org/sa-core-2025-004

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Samuel Mortenson (samuel.mortenson)
Benji Fisher (benjifisher)
Bram Driesen (bramdriesen)
Alex Bronstein (effulgentsia)
Jen Lampton (jenlampton)
Lee Rowlands (larowlan)
Dave Long (longwave)
Drew Webber (mcdruid)
Joseph Zhao (pandaski)
Adam G-H (phenaproxima)
Samuel Mortenson (samuel.mortenson)
Jess (xjm)
.