CVE-2025-9550

MediumCVSS 6.1

Published: 10/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

8th percentile - higher than 8% of all known CVEs

Summary

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Facets allows Cross-Site Scripting (XSS). This issue affects Facets: from 0.0.0 before 2.0.10, from 3.0.0 before 3.0.1.

Risk Assessment

Attackers can inject malicious scripts that execute in the user's browser, potentially leading to session or data theft.

Recommendation

Update the Facets module to version 2.0.10 or 3.0.1 (depending on the branch in use) to fix the vulnerability.

Other vulnerabilities in Drupal Facets

CVE-2025-9549Medium
A missing authorization vulnerability in Drupal Facets allows Forceful Browsing. This issue affects Facets: from 0.0.0 before 2.0.10, from 3.0.0 before 3.0.1.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Facets allows Cross-Site Scripting (XSS).This issue affects Facets: from 0.0.0 before 2.0.10, from 3.0.0 before 3.0.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS