CVE-2025-71310
LowCVSS 1.8Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
The GDPR cookies module for Backdrop CMS before version 1.x-1.3.5 does not sufficiently protect visitors from Cross Site Scripting (XSS) if a malicious value has been provided for the optional 'Info content' field for the YouTube service. The attack is mitigated by the fact that an attacker must have a role with permission to create or edit GDPR Cookies services and the site must have a YouTube service configured.
Risk Assessment
The organization is exposed to XSS attacks that could lead to session theft, redirection to malicious sites, or theft of visitor data, provided the attacker has the necessary permissions.
Recommendation
Update the GDPR cookies module for Backdrop CMS to version 1.x-1.3.5 or later, which includes a fix that prevents XSS.
Original NVD description (English source)
The GDPR cookies module for Backdrop CMS (before 1.x-1.3.5) doesn't sufficiently protect visitors from Cross Site Scripting (XSS) if a malicious value has been provided for the optional 'Info content' field for the YouTube service. This is mitigated by the fact that an attacker must have a role with the permission "Create a GDPR Cookies Service" or "Edit any GDPR Cookies Service" and a site must have added a YouTube service as configuration.