CVE-2025-13981 is a medium severity Cross-Site Scripting (XSS) vulnerability in the Drupal AI module affecting versions prior to 1.0.7, 1.1.7, and 1.2.4. It arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. Exploitation requires network access, low privileges, and user interaction, with a complexity rated as high. While no known exploits are currently active in the wild, successful attacks could lead to limited confidentiality and integrity impacts, such as session hijacking or defacement.
CVE-2025-13980 is an authentication bypass vulnerability in Drupal's CKEditor 5 Premium Features that allows attackers to bypass authentication without any user interaction or privileges. It affects multiple versions prior to fixed releases, enabling unauthorized access through alternate paths or channels. The vulnerability has a medium severity with a CVSS score of 5.3, impacting confidentiality but not integrity or availability. No known exploits are currently reported in the wild. European organizations using affected Drupal CKEditor 5 Premium Features versions could face unauthorized access risks, particularly those with public-facing Drupal sites. Mitigation requires prompt updating to patched versions beyond 1.2.10, 1.3.
CVE-2025-13979 is a medium severity vulnerability in the Drupal Mini site module versions before 3.0.2. It involves a privilege defined with unsafe actions (CWE-267) that allows an authenticated user with certain privileges to perform stored Cross-Site Scripting (XSS) attacks without requiring user interaction. The vulnerability impacts confidentiality and integrity but does not affect availability. Exploitation requires network access and low complexity with privileges, but no user interaction. There are no known exploits in the wild yet, and no patches have been linked. European organizations using affected Drupal Mini site versions should prioritize updating to mitigate risks, especially those with web-facing Drupal installations. Countries with higher Drupal adoption and critical infrastructure relying on Drupal are more likely to be impacted.
CVE-2025-14557 is a stored Cross-site Scripting (XSS) vulnerability in the Drupal Facebook Pixel module versions 7.x-1.0 through 7.x-1.1. It arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that persist on affected sites. The vulnerability has a medium severity with a CVSS score of 4.8 and does not require authentication but does require user interaction. While no known exploits are currently reported in the wild, exploitation could lead to session hijacking, defacement, or redirection to malicious sites. European organizations using the affected Drupal module should prioritize patching or mitigating this issue to prevent potential compromise.
CVE-2025-14556 is a medium severity Cross-Site Scripting (XSS) vulnerability affecting the Drupal Flag module versions 7.x-3.0 through 7.x-3.9. It arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. The vulnerability can be exploited remotely without authentication but requires user interaction. While no known exploits are currently in the wild, successful exploitation could lead to session hijacking, defacement, or redirection attacks. European organizations using affected Drupal versions are at risk, especially those with public-facing websites relying on the Flag module. Mitigation involves updating to a patched version once available, applying strict input validation, and implementing Content Security Policies.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Simple multi step form allows Cross-Site Scripting (XSS).This issue affects Simple multi step form: from 0.0.0 before 2.0.0.
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email TFA allows Functionality Bypass.This issue affects Email TFA: from 0.0.0 before 2.0.6.
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8, from 7.0 before 7.103.
User Interface (UI) Misrepresentation of Critical Information vulnerability in Drupal Drupal core allows Content Spoofing.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.
Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CivicTheme Design System allows Cross-Site Scripting (XSS).This issue affects CivicTheme Design System: from 0.0.0 before 1.12.0.
Incorrect Authorization vulnerability in Drupal CivicTheme Design System allows Forceful Browsing.This issue affects CivicTheme Design System: from 0.0.0 before 1.12.0.
Improper Validation of Consistency within Input vulnerability in Drupal Reverse Proxy Header allows Manipulating User-Controlled Variables.This issue affects Reverse Proxy Header: from 0.0.0 before 1.1.2.
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Currency allows Cross Site Request Forgery.This issue affects Currency: from 0.0.0 before 3.5.0.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Umami Analytics allows Cross-Site Scripting (XSS).This issue affects Umami Analytics: from 0.0.0 before 1.0.1.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Plausible tracking allows Cross-Site Scripting (XSS).This issue affects Plausible tracking: from 0.0.0 before 1.0.2.
