CVE-2025-3738

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

Vulnerability in Drupal Google Optimize.This issue affects Google Optimize: *.*.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

Affected software

No affected versions have been published.

Timeline

Published
Apr 16, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-37395.9Vulnerability in Drupal Drupal 8 Google Optimize Hide Page.This issue affects Drupal 8 Google Optimize Hide Page: *.*.CVE-2025-37408.8The School Management System for Wordpress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, CVE-2025-37426.8The Responsive Lightbox & Gallery WordPress plugin before 2.5.1 does not validate and escape some of its attributes before outputting them bCVE-2025-37435.3The Upsell Funnel Builder for WooCommerce plugin for WordPress is vulnerable to order manipulation in all versions up to, and including, 3.0CVE-2025-37447.6Nomad Enterprise (“Nomad”) jobs using the policy override option are bypassing the mandatory sentinel policies. This vulnerability, identifiCVE-2025-37456.3The WP Lightbox 2 WordPress plugin before 3.0.6.8 does not correctly sanitize the value of the title attribute of links before using them, wCVE-2025-37469.8The OTP-less one tap Sign in plugin for WordPress is vulnerable to privilege escalation via account takeover in versions 2.0.14 to 2.0.59. TCVE-2025-37485.4The Taxonomy Chain Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's pn_chain_menu shortcode in all veCVE-2025-37496.4The Breeze Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘cal_size’ parameter in all versions up to, andCVE-2025-37506.4The Network Posts Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘post_height’ parameter in all versionsCVE-2025-37517.0The component listed above contains a vulnerability that can be exploited by an attacker to perform a SQL Injection attack. This could lead CVE-2025-37526.4The Able Player, accessible HTML5 media player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘preload’ parameter
CVE-2025-3738: Medium severity, CVSS 5.9 | Vulnix