CVE-2025-44141
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
A Cross-Site Scripting (XSS) vulnerability exists in the node creation form of Backdrop CMS 1.30. It allows injection of malicious JavaScript code into the page.
Risk Assessment
An attacker can exploit this vulnerability to steal user sessions, take over administrator accounts, or distribute malware within the organization.
Recommendation
Immediately update Backdrop CMS to the latest version that includes a fix for this XSS vulnerability.
Other vulnerabilities in Backdrop CMS
See all- CVE-2025-71310Low
The GDPR cookies module for Backdrop CMS before version 1.x-1.3.5 does not sufficiently protect visitors from Cross Site Scripting (XSS) if a malicious value has been provided for the optional 'Info content' field for the YouTube service. The attack is mitigated by the fact that an attacker must have a role with permission to create or edit GDPR Cookies services and the site must have a YouTube service configured.
- CVE-2022-34530Medium
An issue in the login and reset password functionality of Backdrop CMS v1.22.0 allows attackers to enumerate usernames via password reset requests and distinct responses returned based on usernames.
Original NVD description (English source)
A Cross-Site Scripting (XSS) vulnerability exists in the node creation form of Backdrop CMS 1.30.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS