Cross-site Scripting Vulnerability in Drupal Paragraphs by Drupal
CVE-2025-6677

5.4MEDIUM

Key Information:

Vendor

Drupal
Status
Paragraphs Table
Vendor
CVE Published:
26 June 2025

What is CVE-2025-6677?

A Cross-site Scripting vulnerability exists in the Drupal Paragraphs module. This flaw stems from improper handling of user input during web page generation, potentially allowing an attacker to inject malicious scripts into web pages viewed by users. This can compromise user data and expose applications to further attacks. The issue affects versions prior to 2.0.5 of the Paragraphs module.

Affected Version(s)

Paragraphs table 2.0.0 < 2.0.5

References

https://www.drupal.org/sa-contrib-2025-084

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Pierre Rudloff (prudloff)
Joseph Olstad (joseph.olstad)
NGUYEN Bao (lazzyvn)
Greg Knaddison (greggles)
Juraj Nemec (poker10)
.
CVE-2025-6677 : Cross-site Scripting Vulnerability in Drupal Paragraphs by Drupal