DRUPAL-CONTRIB-2023-016

DRUPAL-CONTRIB-2023-016

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The Iubenda Integration module provides a custom block to provide a link to the Iubenda privacy policy. On this block, a custom prefix and suffix text can be entered. The module does not sufficiently filter the block text fields on output, resulting in a Cross-Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with permission to use the layout builder on content, edit the layout, or with the "Administer blocks" permission.

Fix available

Published

2023-05-31T13:14:25Z

Updated

2026-09-10T03:45:56.303115771Z

Stack: php

Check your server →