AIKIDO-2025-10783
drupal/simple_multistep is vulnerable to Cross-site Scripting (XSS)
50
Medium Risk
This Affects:
drupal/simple_multistepTL;DR
This module allows converting any entity form into a simple multi-step form. It fails to properly sanitize certain user-supplied text, leading to a cross-site scripting (XSS) vulnerability. Exploitation of this issue is limited to users with the “administer node form display” permission.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
drupal/simple_multistep is vulnerable to Cross-site Scripting (XSS) in versions 1.0.0 - 1.0.0.
How to fix this
Upgrade the drupal/simple_multistep library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant