Cross-Site Scripting Vulnerability in COOKiES Consent Management by Drupal
CVE-2025-48914

8.6HIGH

Key Information:

Vendor

Drupal
Status
Cookies Consent Management
Vendor
CVE Published:
13 June 2025

What is CVE-2025-48914?

A Cross-Site Scripting (XSS) vulnerability exists in the COOKiES Consent Management module for Drupal, allowing attackers to inject malicious scripts into web pages. This vulnerability affects versions from 0.0.0 to prior to 1.2.15. If exploited, it can lead to unauthorized actions on behalf of users and potentially compromise sensitive information.

Affected Version(s)

COOKiES Consent Management 0.0.0 < 1.2.15

References

https://www.drupal.org/sa-contrib-2025-075

CVSS V3.1

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Pierre Rudloff (prudloff)
Julian Pustkuchen (anybody)
Joshua Sedler (grevil)
Joachim Feltkamp (jfeltkamp)
Juraj Nemec (poker10)
Cathy Theys (yesct)
.
CVE-2025-48914 : Cross-Site Scripting Vulnerability in COOKiES Consent Management by Drupal