Cross-Site Scripting Vulnerability in COOKiES Consent Management for Drupal
CVE-2025-48915

8.6HIGH

Key Information:

Vendor

Drupal
Status
Cookies Consent Management
Vendor
CVE Published:
13 June 2025

What is CVE-2025-48915?

A Cross-Site Scripting (XSS) vulnerability exists in the COOKiES Consent Management module for Drupal, permitting attackers to inject malicious scripts into web pages viewed by users. This flaw arises due to improper handling of user input during page generation. Version 1.2.15 addresses the issue; installations before this version are susceptible. Admins are urged to upgrade promptly and review security best practices to mitigate potential exploitation.

Affected Version(s)

COOKiES Consent Management 0.0.0 < 1.2.15

References

https://www.drupal.org/sa-contrib-2025-076

CVSS V3.1

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Pierre Rudloff (prudloff)
Joachim Feltkamp (jfeltkamp)
Greg Knaddison (greggles)
Juraj Nemec (poker10)
Cathy Theys (yesct)
.
CVE-2025-48915 : Cross-Site Scripting Vulnerability in COOKiES Consent Management for Drupal