CVE-2025-3733

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal baguetteBox.Js allows Cross-Site Scripting (XSS).This issue affects baguetteBox.Js: from 0.0.0 before 2.0.4, from 3.0.0 before 3.0.1.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Drupal	baguetteBox.js	>= 0.0.0, < 2.0.4; >= 3.0.0, < 3.0.1

References

https://www.drupal.org/sa-contrib-2025-034Third Party Advisory

Timeline

Published: Apr 16, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-37345.9Allocation of Resources Without Limits or Throttling vulnerability in Drupal Stage File Proxy allows Flooding.This issue affects Stage File CVE-2025-37355.9Vulnerability in Drupal Panelizer (obsolete).This issue affects Panelizer (obsolete): *.*.CVE-2025-37365.9Vulnerability in Drupal Simple GTM.This issue affects Simple GTM: *.*.CVE-2025-37375.9Vulnerability in Drupal Google Maps: Store Locator.This issue affects Google Maps: Store Locator: *.*.CVE-2025-37385.9Vulnerability in Drupal Google Optimize.This issue affects Google Optimize: *.*.CVE-2025-37395.9Vulnerability in Drupal Drupal 8 Google Optimize Hide Page.This issue affects Drupal 8 Google Optimize Hide Page: *.*.CVE-2025-37408.8The School Management System for Wordpress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, CVE-2025-37426.8The Responsive Lightbox & Gallery WordPress plugin before 2.5.1 does not validate and escape some of its attributes before outputting them b CVE-2025-37435.3The Upsell Funnel Builder for WooCommerce plugin for WordPress is vulnerable to order manipulation in all versions up to, and including, 3.0 CVE-2025-37447.6Nomad Enterprise (“Nomad”) jobs using the policy override option are bypassing the mandatory sentinel policies. This vulnerability, identifi CVE-2025-37456.3The WP Lightbox 2 WordPress plugin before 3.0.6.8 does not correctly sanitize the value of the title attribute of links before using them, w CVE-2025-37469.8The OTP-less one tap Sign in plugin for WordPress is vulnerable to privilege escalation via account takeover in versions 2.0.14 to 2.0.59. T