Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.14, from 10.4.0 before 10.4.5, from 11.0.0 before 11.0.13, from 11.1.0 before 11.1.5. It also affects the Drupal 7 module from versions 7.x-1.0 through 7.x-1.12.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in
    Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before
    10.3.14, from 10.4.0 before 10.4.5, from 11.0.0 before 11.0.13, from 11.1.0 before 11.1.5. It also affects
    the Drupal 7 module from versions 7.x-1.0 through 7.x-1.12. (CVE-2025-31675)

According to its self-reported version, the instance of Drupal running on the remote web server is 11.1.x prior to 11.1.5, 11.0.x prior to 11.0.13, 10.4.x prior to 10.4.5 or 8.x prior to 10.3.14. Drupal core Link field attributes are not sufficiently sanitized, which can lead to a Cross-Site Scripting vulnerability (XSS).

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the instance of Drupal running on the remote web server is 10.3.x prior to 10.3.14, 10.4.x prior to 10.4.5, 11.x prior to 11.0.13, or 11.1.x prior to 11.1.5. It is, therefore, affected by a vulnerability.

  - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in     Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before     10.3.14, from 10.4.0 before 10.4.5, from 11.0.0 before 11.0.13, from 11.1.0 before 11.1.5.
    (CVE-2025-31675)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
423605	SCA: security update for drupal/core (GHSA-m4wj-hhwj-47qp)	Tenable Cloud Security	SCA Checks	medium
423605	SCA: security update for drupal/core (GHSA-m4wj-hhwj-47qp)	Tenable Self-Hosted Container Security	SCA Checks	medium
114679	Drupal 8.0.x < 10.3.14 Cross-Site Scripting	Web App Scanning	Component Vulnerability	medium
114678	Drupal 10.4.x < 10.4.5 Cross-Site Scripting	Web App Scanning	Component Vulnerability	medium
114677	Drupal 11.0.x < 11.0.13 Cross-Site Scripting	Web App Scanning	Component Vulnerability	medium
114676	Drupal 11.1.x < 11.1.5 Cross-Site Scripting	Web App Scanning	Component Vulnerability	medium
232982	Drupal 10.3.x < 10.3.14 / 10.4.x < 10.4.5 / 11.x < 11.0.13 / 11.1.x < 11.1.5 Drupal Vulnerability (SA-CORE-2025-004)	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2025-31675

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium