Cross-Site Scripting in Drupal Block Class by Drupal

CVE-2025-3902

Summary

An improper neutralization of input during web page generation in the Block Class of Drupal makes it susceptible to cross-site scripting (XSS) attacks. This vulnerability arises when user inputs are not adequately sanitized, allowing attackers to inject malicious scripts into web pages viewed by other users. Such exploits can lead to a variety of security issues, including data theft, session hijacking, and unauthorized actions on behalf of users. The affected version of Block Class ranges from 4.0.0 prior to 4.0.1. It is essential for users of Drupal to update their installations to mitigate this risk.

References