XSS Vulnerability in Simple Klaro Plugin for Drupal
CVE-2025-48918

8.8HIGH

Key Information:

Vendor

Drupal
Status
Simple Klaro
Vendor
CVE Published:
13 June 2025

What is CVE-2025-48918?

The Simple Klaro plugin for Drupal contains a vulnerability that allows for improper neutralization of input during web page generation, leading to Cross-Site Scripting (XSS) attacks. This issue has been identified in versions from 0.0.0 up to, but not including, 1.10.0. Attackers can exploit this vulnerability to inject malicious scripts into web pages, potentially compromising user sessions or redirecting users to malicious sites. It is crucial for site administrators to upgrade to the latest version to mitigate this risk.

Affected Version(s)

Simple Klaro 0.0.0 < 1.10.0

References

https://www.drupal.org/sa-contrib-2025-071

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Pierre Rudloff (prudloff)
Norman Kämper-Leymann (norman.lol)
Juraj Nemec (poker10)
Pierre Rudloff (prudloff)
Cathy Theys (yesct)
.
CVE-2025-48918 : XSS Vulnerability in Simple Klaro Plugin for Drupal