CVE-2025-3733

CVE-2025-3733: baguetteBox.js - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-034

Vendor Drupal
Product baguetteBox.js
Weakness CWE-79 · XSS
Published April 16, 2025
Last update April 16, 2025
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal baguetteBox.Js allows Cross-Site Scripting (XSS).This issue affects baguetteBox.Js: from 0.0.0 before 2.0.4, from 3.0.0 before 3.0.1.

Key dates

02Disclosure timeline

April 16, 2025 CVE published
April 16, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-47946 symfony/ux-live-component and symfony/ux-twig-component vulnerable to unsanitized HTML attribute injection via ComponentAttributes CVE-2025-60177 WordPress Recaptcha – wp Plugin <= 0.2.6 - Cross Site Scripting (XSS) Vulnerability CVE-2025-5488 WP Masonry & Infinite Scroll <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-39400 WordPress User Registration plugin < 4.2.0 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2023-25044 WordPress Social Share Boost Plugin <= 4.4 is vulnerable to Cross Site Scripting (XSS)