PT-2025-30310 · Drupal · Drupal Block Attributes

Greg Knaddison + 4 · CVE-2025-7715 · Published 2025-07-21 · Updated 2025-08-26

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Drupal Block Attributes versions 0.0.0 through 1.0.9 Drupal Block Attributes versions 2.0.0 through 2.0.0

Description A flaw exists in Drupal Block Attributes that allows for Cross-Site Scripting (XSS). This issue is due to improper neutralization of input during web page generation.

Recommendations Update Drupal Block Attributes to version 1.1.0 or later. Update Drupal Block Attributes to version 2.0.1 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-7715

DRUPAL-CONTRIB-2025-090

Affected Products

Drupal Block Attributes

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/7xxx/CVE-2025-7715.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-7715 · Security Note
• https://osv.dev/vulnerability/CVE-2025-7715 · Vendor Advisory
• https://twitter.com/CVEnew/status/1947339043185820009 · Twitter Post
• https://drupal.org/project/block_attributes · Note
• https://drupal.org/sa-contrib-2025-090 · Note
• https://git.drupalcode.org/project/block_attributes · Note
• https://t.me/cveNotify/133588 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1947397213463740885 · Twitter Post