Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

36added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

36 results

Oct 16, 2026Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 does not sufficiently validate uploaded SVG images to ensure they lack potentially dangerous SVGCVE-2026-111442 · Other software · BackdropCMS · reported by MITREMedium 5.3
Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 does not sufficiently validate uploaded SVG images to ensure they lack potentially dangerous SVG tags. SVG images can contain clickable links or executable scripting. By uploading a crafted SVG, it is possible to execute scripting in the browser when an SVG image is viewed. This issue is mitigated by the attacker needing to be able to upload SVG images, and that Backdrop embeds all uploaded SVG images within <img> tags, which prevents script from executing. The SVG must be viewed directly by its URL in order to run any embedded scripting.
Product
Backdrop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record backdropcms.org
Oct 14, 2026Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens.CVE-2026-110907 · Other software · BackdropCMS · reported by MITREHigh 7.5
Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens. A token is a small placeholder string (like [node:title] or [user:name]) used to automatically insert dynamic data into text. A browser is provided for selecting tokens by type. The product doesn't sufficiently limit access to the types of tokens that are available in the token browser. The names of the individual tokens are adequately protected.
Product
Backdrop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record backdropcms.org
Oct 9, 2026Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently protect configuration exports when delivering a compressed archive.CVE-2026-107914 · Other software · backdropcms · reported by MITREHigh 7.8
Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently protect configuration exports when delivering a compressed archive. This vulnerability is mitigated by the fact that an export must have been previously requested by someone with the "Synchronize, import, and export configuration" permission. NOTE: CVE-2026-107914 refers to the vulnerability in which config.admin.inc does not ensure that a file_unmanaged_delete operation occurs. Therefore, many archives could persist: config.tar.gz, config_0.tar.gz, config_1.tar.gz, etc. There is a separate config.module issue that could allow remote access by an anonymous user, but only for the one filename config.tar.gz.
Product
Backdrop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record backdropcms.org github.com
Oct 2, 2026Backdrop CMS before 1.35.1 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve configuration export archives leftCVE-2026-104476 · Other software · backdrop · reported by VulnCheckHigh 8.2
Backdrop CMS before 1.35.1 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve configuration export archives left on the server after transfer. Attackers can download compressed archives generated by users with configuration export permission to obtain the full site configuration, including sensitive settings.
Product
backdrop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record backdropcms.org github.com
May 25, 2026The GDPR cookies module for Backdrop CMS (before 1.x-1.3.5) doesn't sufficiently protect visitors from Cross Site Scripting (XSS) if a malicious value has beeCVE-2025-71310 · Other software · BackdropCMS · reported by MITRELow 1.8
The GDPR cookies module for Backdrop CMS (before 1.x-1.3.5) doesn't sufficiently protect visitors from Cross Site Scripting (XSS) if a malicious value has been provided for the optional 'Info content' field for the YouTube service. This is mitigated by the fact that an attacker must have a role with the permission "Create a GDPR Cookies Service" or "Edit any GDPR Cookies Service" and a site must have added a YouTube service as configuration.
Product
GDPR cookies module for Backdrop CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record backdropcms.org
May 12, 2026The Salesforce module before 1.x-1.0.1 for Backdrop CMS does not properly use a random state parameter to protect the authorization flow against CSRF attacks.CVE-2026-45430 · Other software · Backdrop CMS contributed projects · reported by MITREHigh 7.1
The Salesforce module before 1.x-1.0.1 for Backdrop CMS does not properly use a random state parameter to protect the authorization flow against CSRF attacks.
Product
backdrop-contrib/salesforce
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record backdropcms.org
Nov 18, 2025Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate the Host header in password reset requests, leading to redirects to maCVE-2025-63828 · Other software · Backdropcms · reported by MITREMedium 6.1
Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate the Host header in password reset requests, leading to redirects to malicious domains and potential session hijacking via cookie injection.
Product
Backdrop CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 26, 2025A Cross-Site Scripting (XSS) vulnerability exists in the node creation form of Backdrop CMS 1.30.CVE-2025-44141 · Other software · Backdropcms · reported by MITREMedium 6.1
A Cross-Site Scripting (XSS) vulnerability exists in the node creation form of Backdrop CMS 1.30.
Product
Backdrop CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record scandalous-author-611.notion.site
Apr 24, 2025An XSS issue was discovered in the Flag module before 1.x-3.6.2 for Backdrop CMS.CVE-2025-46595 · Other software · backdropcms · reported by MITREMedium 6.4
An XSS issue was discovered in the Flag module before 1.x-3.6.2 for Backdrop CMS. Flag is a module that allows flags to be added to nodes, comments, users, and any other type of entity. It doesn't verify flag links before performing the flag action, or verify that the response returned was provided by the flag module. This can allow crafted HTML to result in Cross Site Scripting. This is mitigated by the fact that an attacker must have a role with permission to create links on the website, for example: create or edit comments or content with a filtered text format.
Product
Flag
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record backdropcms.org
Mar 7, 2025An XSS issue was discovered in the Bootstrap Lite theme before 1.x-1.4.5 for Backdrop CMS.CVE-2025-27826 · Other software · backdropcms · reported by MITREMedium 6.4
An XSS issue was discovered in the Bootstrap Lite theme before 1.x-1.4.5 for Backdrop CMS. It doesn't sufficiently sanitize certain class names.
Product
Bootstrap Lite theme
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record backdropcms.org
Mar 7, 2025An XSS issue was discovered in the Bootstrap 5 Lite theme before 1.x-1.0.3 for Backdrop CMS.CVE-2025-27825 · Other software · backdropcms · reported by MITREMedium 6.4
An XSS issue was discovered in the Bootstrap 5 Lite theme before 1.x-1.0.3 for Backdrop CMS. It doesn't sufficiently sanitize certain class names.
Product
Bootstrap 5 Lite theme
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record backdropcms.org
Mar 7, 2025An XSS issue was discovered in the Link iframe formatter module before 1.x-1.1.1 for Backdrop CMS.CVE-2025-27824 · Other software · backdropcms · reported by MITREMedium 6.4
An XSS issue was discovered in the Link iframe formatter module before 1.x-1.1.1 for Backdrop CMS. It doesn't sufficiently sanitize input before displaying results to the screen. This vulnerability is mitigated by the fact that an attacker must have the ability to create content containing an iFrame field.
Product
Link iframe formatter
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record backdropcms.org
Mar 7, 2025An issue was discovered in the Mail Disguise module before 1.x-1.0.5 for Backdrop CMS.CVE-2025-27823 · Other software · backdropcms · reported by MITREMedium 6.4
An issue was discovered in the Mail Disguise module before 1.x-1.0.5 for Backdrop CMS. It enables a website to obfuscate email addresses, and should prevent spambots from collecting them. The module doesn't sufficiently validate the data attribute value on links, potentially leading to a Cross Site Scripting (XSS) vulnerability. This is mitigated by the fact an attacker must be able to insert link (<a>) HTML elements containing data attributes into the page.
Product
Mail Disguise
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record backdropcms.org
Mar 7, 2025An issue was discovered in the Masquerade module before 1.x-1.0.1 for Backdrop CMS.CVE-2025-27822 · Other software · backdropcms · reported by MITREHigh 7.5
An issue was discovered in the Masquerade module before 1.x-1.0.1 for Backdrop CMS. It allows people to temporarily switch to another user account. The module provides a "Masquerade as admin" permission to restrict people (who can masquerade) from switching to an account with administrative privileges. This permission is not always honored and may allow non-administrative users to masquerade as an administrator. This vulnerability is mitigated by the fact that an attacker must have a role with the "Masquerade as user" permission.
Product
Masquerade
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record backdropcms.org
Feb 2, 2025An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3.CVE-2025-25063 · Other software · backdropcms · reported by MITREMedium 4.4
An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It does not sufficiently validate uploaded SVG images to ensure they do not contain potentially dangerous SVG tags. SVG images can contain clickable links and executable scripting, and using a crafted SVG, it is possible to execute scripting in the browser when an SVG image is viewed. This issue is mitigated by the attacker needing to be able to upload SVG images, and that Backdrop embeds all uploaded SVG images within <img> tags, which prevents scripting from executing. The SVG must be viewed directly by its URL in order to run any embedded scripting.
Product
backdrop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record backdropcms.org
Feb 2, 2025An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3.CVE-2025-25062 · Other software · backdropcms · reported by MITREMedium 4.4
An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It doesn't sufficiently isolate long text content when the CKEditor 5 rich text editor is used. This allows a potential attacker to craft specialized HTML and JavaScript that may be executed when an administrator attempts to edit a piece of content. This vulnerability is mitigated by the fact that an attacker must have the ability to create long text content (such as through the node or comment forms) and an administrator must edit (not view) the content that contains the malicious content. This problem only exists when using the CKEditor 5 module.
Product
backdrop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record backdropcms.org medium.com
Nov 28, 2024Backdrop CMS before 1.28.4 and 1.29.x before 1.29.2 allows XSS via an SVG document, if the SVG tag is allowed for a text format.CVE-2024-54123 · Other software · Backdropcms · reported by MITREMedium 6.1
Backdrop CMS before 1.28.4 and 1.29.x before 1.29.2 allows XSS via an SVG document, if the SVG tag is allowed for a text format.
Product
Backdrop CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record backdropcms.org
Jul 22, 2024Backdrop CMS before 1.27.3 and 1.28.x before 1.28.2 does not sufficiently sanitize field labels before they are displayed in certain places.CVE-2024-41709 · Other software · Backdropcms · reported by MITREMedium 4.8
Backdrop CMS before 1.27.3 and 1.28.x before 1.28.2 does not sufficiently sanitize field labels before they are displayed in certain places. This vulnerability is mitigated by the fact that an attacker must have a role with the "administer fields" permission.
Product
Backdrop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record backdropcms.org backdropcms.org
Apr 24, 2023A stored Cross-site scripting (XSS) issue in Text Editors and Formats in Backdrop CMS before 1.24.2 allows remote attackers to inject arbitrary web script or HTCVE-2023-31045 · Other software · backdropcms · reported by MITREMedium 4.8
A stored Cross-site scripting (XSS) issue in Text Editors and Formats in Backdrop CMS before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via the name parameter. When a user is editing any content type (e.g., page, post, or card) as an admin, the stored XSS payload is executed upon selecting a malicious text formatting option. NOTE: the vendor disputes the security relevance of this finding because "any administrator that can configure a text format could easily allow Full HTML anywhere."
Product
backdrop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 20, 2023The Borg theme before 1.1.19 for Backdrop CMS does not sufficiently sanitize path arguments that are passed in via a URL.CVE-2023-26265 · Other software · Borg Project · reported by MITREMedium 5.3
The Borg theme before 1.1.19 for Backdrop CMS does not sufficiently sanitize path arguments that are passed in via a URL. The function borg_preprocess_page in the file template.php does not properly sanitize incoming path arguments before using them.
Product
Borg
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record backdropcms.org github.com
Nov 22, 2022Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Page content.CVE-2022-42095 · Other software · Backdropcms · reported by MITREMedium 4.8
Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Page content.
Product
Backdrop CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record backdropcms.org github.com
Nov 22, 2022Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via 'Comment.' .CVE-2022-42097 · Other software · Backdropcms · reported by MITREMedium 4.8
Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via 'Comment.' .
Product
Backdrop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record backdropcms.org github.com
Nov 22, 2022Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the 'Card' content.CVE-2022-42094 · Other software · Backdropcms · reported by MITREMedium 4.8
Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the 'Card' content.
Product
Backdrop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record backdropcms.org github.com
Nov 21, 2022Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via Post content.CVE-2022-42096 · Other software · Backdropcms · reported by MITREMedium 4.8
Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via Post content.
Product
Backdrop CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record backdropcms.org github.com
Oct 7, 2022Backdrop CMS 1.22.0 has Unrestricted File Upload vulnerability via 'themes' that allows attackers to Remote Code Execution.CVE-2022-42092 · Other software · Backdropcms · reported by MITREHigh 7.2
Backdrop CMS 1.22.0 has Unrestricted File Upload vulnerability via 'themes' that allows attackers to Remote Code Execution. Note: Third parties dispute this and argue that advanced permissions are required.
Product
Backdrop CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record grimthereaperteam.medium.com grimthereaperteam.medium.com
Aug 1, 2022An issue in the login and reset password functionality of Backdrop CMS v1.22.0 allows attackers to enumerate usernames via password reset requests and distinct CVE-2022-34530 · Other software · Backdropcms · reported by MITREMedium 5.3
An issue in the login and reset password functionality of Backdrop CMS v1.22.0 allows attackers to enumerate usernames via password reset requests and distinct responses returned based on usernames.
Product
Backdrop CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 3, 2022A Cross Site Request Forgery (CSRF) vulnerability exists in Backdrop CMS 1.20, which allows Remote Attackers to gain Remote Code Execution (RCE) on the Hosting CVE-2021-45268 · Other software · Backdropcms · reported by MITREHigh 8.8
A Cross Site Request Forgery (CSRF) vulnerability exists in Backdrop CMS 1.20, which allows Remote Attackers to gain Remote Code Execution (RCE) on the Hosting Webserver via uploading a maliciously add-on with crafted PHP file. NOTE: the vendor disputes this because the attack requires a session cookie of a high-privileged authenticated user who is entitled to install arbitrary add-ons
Product
Backdrop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com exploit-db.com
Dec 19, 2019An issue was discovered in Backdrop CMS 1.14.x before 1.14.2.CVE-2019-19903 · Other software · Backdropcms · reported by MITREMedium 4.8
An issue was discovered in Backdrop CMS 1.14.x before 1.14.2. It doesn't sufficiently filter output when displaying file type descriptions created by administrators. An attacker could potentially craft a specialized description, then have an administrator execute scripting when viewing the list of file types, aka XSS. This vulnerability is mitigated by the fact that an attacker must have a role with the "Administer file types" permission.
Product
Backdrop CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record backdropcms.org backdropcms.org
Dec 19, 2019An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2.CVE-2019-19902 · Other software · Backdropcms · reported by MITREHigh 7.2
An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2. It allows the upload of entire-site configuration archives through the user interface or command line. It does not sufficiently check uploaded archives for invalid data, allowing non-configuration scripts to potentially be uploaded to the server. This issue is mitigated by the fact that the attacker would be required to have the "Synchronize, import, and export configuration" permission, a permission that only trusted administrators should be given. Other measures in the product prevent the execution of PHP scripts, so another server-side scripting language must be accessible on the server to execute code.
Product
Backdrop CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record backdropcms.org backdropcms.org
Dec 19, 2019An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2.CVE-2019-19901 · Other software · Backdropcms · reported by MITREMedium 4.8
An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2. It doesn't sufficiently filter output when displaying certain block descriptions created by administrators. An attacker could potentially craft a specialized description, then have an administrator execute scripting when configuring a layout, aka XSS. This issue is mitigated by the fact that the attacker would be required to have the permission to create custom blocks, which is typically an administrative task.
Product
Backdrop CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record backdropcms.org backdropcms.org
Dec 19, 2019An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2.CVE-2019-19900 · Other software · Backdropcms · reported by MITREMedium 4.8
An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2. It doesn't sufficiently filter output when displaying content type names in the content creation interface. An attacker could potentially craft a specialized content type name, then have an editor execute scripting when creating content, aka XSS. This vulnerability is mitigated by the fact that an attacker must have a role with the "Administer content types" permission.
Product
Backdrop CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record backdropcms.org backdropcms.org
Aug 7, 2019Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3 allows the upload of entire-site configuration archives through the user interface or command line.CVE-2019-14771 · Other software · Backdropcms · reported by MITRECritical 9.8
Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3 allows the upload of entire-site configuration archives through the user interface or command line. It does not sufficiently check uploaded archives for invalid data, potentially allowing non-configuration scripts to be uploaded to the server. (This attack is mitigated by the attacker needing the "Synchronize, import, and export configuration" permission, a permission that only trusted administrators should be given. Other preventative measures in Backdrop CMS prevent the execution of PHP scripts, so another server-side scripting language must be accessible on the server to execute code.) Note: This has been disputed by multiple 3rd parties due to advanced permissions that are needed to exploit.
Product
Backdrop CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record backdropcms.org backdropcms.org
Aug 7, 2019In Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3, some menu links within the administration bar may be crafted to execute JavaScript when the adminCVE-2019-14770 · Other software · Backdropcms · reported by MITREMedium 6.1
In Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3, some menu links within the administration bar may be crafted to execute JavaScript when the administrator is logged in and uses the search functionality. (This issue is mitigated by the attacker needing permissions to create administrative menu links, such as by creating a content type or layout. Such permissions are usually restricted to trusted or administrative users.)
Product
Backdrop Core
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record backdropcms.org backdropcms.org
Aug 7, 2019Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3 doesn't sufficiently filter output when displaying certain block labels created by administrators.CVE-2019-14769 · Other software · Backdropcms · reported by MITREMedium 6.1
Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3 doesn't sufficiently filter output when displaying certain block labels created by administrators. An attacker could potentially craft a specialized label, then have an administrator execute scripting when administering a layout. (This issue is mitigated by the attacker needing permission to create custom blocks on the site, which is typically an administrative permission.)
Product
Backdrop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record backdropcms.org backdropcms.org
Apr 19, 2019jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution.CVE-2019-11358 · Other software · Jquery · reported by MITREMedium 6.1
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.
Product
Jquery
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.opensuse.org lists.opensuse.org
Dec 20, 2018Backdrop CMS version 1.11.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in Sanitization of custom class names used on blocks and layouts.CVE-2018-1000813 · Other software · Backdropcms · reported by MITREMedium 4.8
Backdrop CMS version 1.11.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in Sanitization of custom class names used on blocks and layouts. that can result in Execution of JavaScript from an unexpected source.. This attack appear to be exploitable via A user must be directed to an affected page while logged in.. This vulnerability appears to have been fixed in 1.11.1 and later.
Product
Backdrop CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record backdropcms.org backdropcms.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.