Vulnerability · Published May 26, 2026 · Assigned by mitre

CVE-2025-71310

Low 1.8

In plain English

A low-severity security flaw in GDPR cookies module for Backdrop CMS from BackdropCMS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 4.0)1.8Low

Exploit odds (30 days)0.3%top 81.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The GDPR cookies module for Backdrop CMS (before 1.x-1.3.5) doesn't sufficiently protect visitors from Cross Site Scripting (XSS) if a malicious value has been provided for the optional 'Info content' field for the YouTube service. This is mitigated by the fact that an attacker must have a role with the permission "Create a GDPR Cookies Service" or "Edit any GDPR Cookies Service" and a site must have added a YouTube service as configuration.

Affected products (as reported)

Vendor	Product	Versions
BackdropCMS	GDPR cookies module for Backdrop CMS	0 – before 1.x-1.3.5

Weakness: CWE-80 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:L

References

https://backdropcms.org/security/sa-contrib-2025-013