The Drupal COOKiES Consent Management module has a vulnerability that allows for improper neutralization of input during web page generation, leading to Cross-Site Scripting (XSS). This issue affects versions from 0.0.0 up to 1.2.16. Attackers can exploit this vulnerability to execute arbitrary scripts in the context of the user’s browser.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.6 | CVE-2025-8092 |
Exploitation
To exploit this vulnerability, an attacker must craft a malicious input that is processed by the COOKiES Consent Management module. This input can be injected into web pages, allowing the attacker to execute scripts in the context of the user’s session, potentially leading to data theft or session hijacking.
Affected Products
- COOKiES Consent Management: A module for managing cookie consent that is vulnerable to XSS attacks in versions 0.0.0 to 1.2.16.
Mitigation
To mitigate this vulnerability, users should upgrade the COOKiES Consent Management module to version 1.2.16 or later. Additionally, implementing input validation and sanitization can help prevent XSS attacks in web applications.