Cross-Site Scripting Vulnerability in Drupal Simple XML Sitemap
CVE-2025-6676

5.4MEDIUM

Key Information:

Vendor

Drupal
Status
Simple Xml Sitemap
Vendor
CVE Published:
26 June 2025

What is CVE-2025-6676?

The Drupal Simple XML Sitemap contains a vulnerability that allows for Cross-Site Scripting (XSS), primarily due to improper input neutralization during web page generation. Attackers may exploit this weakness to inject malicious scripts, potentially impacting users who view the affected pages. It is crucial for users and administrators to upgrade to version 4.2.2 or later to mitigate this security risk.

Affected Version(s)

Simple XML sitemap 0.0.0 < 4.2.2

References

https://www.drupal.org/sa-contrib-2025-083

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nick Vanpraet (grayle)
David Rothstein (David_Rothstein)
Pawel Ginalski (gbyte)
Greg Knaddison (greggles)
Michael Hess (mlhess)
Juraj Nemec (poker10)
.
CVE-2025-6676 : Cross-Site Scripting Vulnerability in Drupal Simple XML Sitemap