TI-2025-43431 Aliases CVE-2025-71310 GHSA-2m22-x9h5-mq25

Cross-site scripting in backdropcms GDPR cookies module for Backdrop CMS

LOW 10CWE-80Published 2026-05-26 · Updated 2026-05-26

Key facts

Attack vector: Network
Privileges required: High
User interaction: Active
Attack complexity: High
Attack requirements: Present
Impact type: Cross-site scripting
Confidentiality · integrity · availability: None · None · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-80.

Summary

The GDPR cookies module for Backdrop CMS (before 1.x-1.3.5) doesn't sufficiently protect visitors from Cross Site Scripting (XSS) if a malicious value has been provided for the optional 'Info content' field for the YouTube service. This is mitigated by the fact that an attacker must have a role with the permission "Create a GDPR Cookies Service" or "Edit any GDPR Cookies Service" and a site must have added a YouTube service as configuration.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00264 18th percentileScored 2026-11-07

Fix Fixed GDPR cookies module for Backdrop CMS (BackdropCMS): 1.x-1.3.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
backdropcms	GDPR cookies module for Backdrop CMS	before 1.x-1.3.5	1.x-1.3.5	Patch available	CNA

GDPR cookies module for Backdrop CMS Vendorbackdropcms Affected before 1.x-1.3.5 Fixed in 1.x-1.3.5 Patch available CNA

Remediation

Fix · CNA GDPR cookies module for Backdrop CMS (BackdropCMS) Fixed in 1.x-1.3.5

Timeline

2026-10-02 Threatist record created from CVE-2025-71310
2026-10-03 Alias added: GHSA-2m22-x9h5-mq25

References

Other 1

https://backdropcms.org/security/sa-contrib-2025-013

TI-2019-08480 jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles… CVSS 3.1MEDIUM 6.1
TI-2025-39465 Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate… CVSS 3.1MEDIUM 6.1
TI-2023-14781 A stored Cross-site scripting (XSS) issue in Text Editors and Formats in Backdrop CMS… CVSS 3.1MEDIUM 4.8
TI-2022-20387 Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via 'Comment.' . CVSS 3.1MEDIUM 4.8
TI-2022-20386 Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS)… CVSS 3.1MEDIUM 4.8
TI-2022-20385 Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS)… CVSS 3.1MEDIUM 4.8

See all 34 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences