Vulnerability Description
The GDPR cookies module for Backdrop CMS (before 1.x-1.3.5) doesn't sufficiently protect visitors from Cross Site Scripting (XSS) if a malicious value has been provided for the optional 'Info content' field for the YouTube service. This is mitigated by the fact that an attacker must have a role with the permission "Create a GDPR Cookies Service" or "Edit any GDPR Cookies Service" and a site must have added a YouTube service as configuration.
Related Weaknesses (CWE)
References
FAQ
What is CVE-2025-71310?
CVE-2025-71310 is a documented vulnerability. The GDPR cookies module for Backdrop CMS (before 1.x-1.3.5) doesn't sufficiently protect visitors from Cross Site Scripting (XSS) if a malicious value has been provided for the optional 'Info conten...
How severe is CVE-2025-71310?
CVSS scoring is not yet available for CVE-2025-71310. Check NVD for updates.
Is there a patch for CVE-2025-71310?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.