XSS in Drupal Core

CVE-2025-3057

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3…

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.004 (61.4th percentile) — read the EPSS interpretation.