CVE-2025-7715

CVE-2025-7715: Block Attributes - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-090

Vendor Drupal
Product Block Attributes
Weakness CWE-79 · XSS
Published July 21, 2025
Last update July 22, 2025
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Block Attributes allows Cross-Site Scripting (XSS).This issue affects Block Attributes: from 0.0.0 before 1.1.0, from 2.0.0 before 2.0.1.

Key dates

02Disclosure timeline

July 21, 2025 CVE published
July 22, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-4984 Stored Cross-site Scripting (XSS) vulnerability affecting City Discover in City Referential Manager on Release 3DEXPERIENCE R2025x CVE-2024-43342 WordPress Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin <= 1.6.4 - Cross Site Scripting (XSS) vulnerability CVE-2024-1841 WPBakery Visual Composer <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title tag attribute CVE-2025-48151 WordPress CM Map Locations <= 2.1.6 - Cross Site Scripting (XSS) Vulnerability CVE-2026-3572 iTracker360 <= 2.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'itracker_license' Settings Field