The GDPR cookies module for Backdrop CMS prior to version 1.x-1.3.5 contains an improper neutralization of script-related HTML tags (CWE-80) vulnerability in the 'Info content' field for the YouTube service. This allows a user with high privileges to inject script content leading to a basic XSS condition. The vulnerability requires both specific permissions and configuration to be exploitable. The CVSS 4.0 vector indicates network attack vector, high attack complexity, privileges required, and user interaction needed, with low overall impact metrics.

Successful exploitation could allow an attacker with appropriate permissions to inject malicious script content into the GDPR cookies module's YouTube service info field, potentially affecting users who view this content. However, the impact is limited by the need for elevated privileges and specific configuration, resulting in a low overall severity rating (CVSS 1.8). There are no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict permissions to only trusted users for 'Create a GDPR Cookies Service' and 'Edit any GDPR Cookies Service' roles. Review and validate any configured YouTube service info content to prevent injection of malicious scripts.