{"id":"CVE-2025-5682","aliases":["DRUPAL-CONTRIB-2025-080","EUVD-2025-19188","GHSA-2vww-xx9q-5hxm"],"status":"published","title":"Klaro Cookie \u0026 Consent Management - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-080","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Klaro Cookie \u0026 Consent Management allows Cross-Site Scripting (XSS).This issue affects Klaro Cookie \u0026 Consent Management: from 0.0.0 before 3.0.7.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-08","score":0.00266,"percentile":0.18627,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2025-06-25T18:41:56Z","modified":"2026-10-28T02:30:43Z","fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/klaro","fixed_in":["3.0.7"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/klaro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7"}]}]}],"products":[{"vendor":"drupal","product":"klaro cookie \u0026 consent management"},{"vendor":"klaro_cookie_\\\u0026_consent_management_project","product":"klaro_cookie_\\\u0026_consent_management"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2025-080","tags":["Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-5682","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-2vww-xx9q-5hxm"},{"url":"https://git.drupalcode.org/project/klaro","tags":["web"]},{"url":"https://www.drupal.org/project/klaro","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/5xxx/CVE-2025-5682.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-5682","title":"Klaro Cookie \u0026 Consent Management - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-080","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Klaro Cookie \u0026 Consent Management allows Cross-Site Scripting (XSS).This issue affects Klaro Cookie \u0026 Consent Management: from 0.0.0 before 3.0.7.","status":"published","published":"2025-06-26T13:33:03.887Z","modified":"2025-06-26T14:12:10.936Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:32:29.97618Z"}],"euvd":[{"id":"EUVD-2025-19188","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Klaro Cookie \u0026 Consent Management allows Cross-Site Scripting (XSS).This issue affects Klaro Cookie \u0026 Consent Management: from 0.0.0 before 3.0.7.","status":"published","published":"2025-06-26T13:33:03Z","modified":"2025-06-26T14:12:10Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:16.561416Z"}],"ghsa":[{"id":"GHSA-2vww-xx9q-5hxm","title":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')...","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Klaro Cookie \u0026 Consent Management allows Cross-Site Scripting (XSS).This issue affects Klaro Cookie \u0026 Consent Management: from 0.0.0 before 3.0.7.","status":"published","published":"2025-06-26T18:31:26Z","modified":"2025-06-26T18:31:34Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:02:49.372577Z"}],"nvd":[{"id":"CVE-2025-5682","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Klaro Cookie \u0026 Consent Management allows Cross-Site Scripting (XSS).This issue affects Klaro Cookie \u0026 Consent Management: from 0.0.0 before 3.0.7.","status":"published","published":"2025-06-26T14:15:31.28Z","modified":"2026-06-17T09:48:32.727Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:11:14.781314Z"}],"osv":[{"id":"CVE-2025-5682","title":"Klaro Cookie \u0026 Consent Management - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-080","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Klaro Cookie \u0026 Consent Management allows Cross-Site Scripting (XSS).This issue affects Klaro Cookie \u0026 Consent Management: from 0.0.0 before 3.0.7.","status":"published","published":"2025-06-26T13:33:03.887Z","modified":"2026-10-28T02:30:43.578768092Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:51.190588Z"},{"id":"DRUPAL-CONTRIB-2025-080","description":"Klaro Cookie \u0026 Consent Management module is used for consent management for cookies and external sources. It makes changes to the markup to enable or disable loading.\n\nThe module doesn't sufficiently sanitize some HTML attributes allowing persistent Cross-site Scripting (XSS) attacks.\n\nThis vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific attributes.","status":"published","published":"2025-06-25T18:41:56Z","modified":"2026-09-10T03:46:02.200174045Z","updated_at":"2026-11-02T15:46:13.900249Z"}]}}