{"id":"DRUPAL-CONTRIB-2025-083","aliases":["CVE-2025-6676"],"title":"Simple XML sitemap is a SEO module that allows creating various XML sitemaps of the site's content and submitting them to search engines.","titleSource":"OSV","descriptionSource":"OSV","description":"[Simple XML sitemap](https://www.drupal.org/project/simple_sitemap) is a SEO module that allows creating various XML sitemaps of the site's content and submitting them to search engines.  \nThe module doesn't sufficiently sanitize input when administering it, which leads to a Cross-site scripting (XSS) attack vector.  \nThis vulnerability is mitigated by the fact that an attacker must have the administrative permission 'administer sitemap settings'.","severity":"unknown","score":null,"published":"2025-06-25T18:42:38.000Z","modified":"2026-09-10T03:46:13.130Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist:https://packages.drupal.org/8","name":"drupal/simple_sitemap","sources":[{"name":"OSV · DRUPAL-CONTRIB-2025-083","url":"https://osv.dev/vulnerability/DRUPAL-CONTRIB-2025-083"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"4.2.2"}],"type":"ECOSYSTEM","database_specific":{"constraint":"< 4.2.2"}}],"versions":[],"fixed":["4.2.2"]}],"sourceAffected":[],"references":["https://www.drupal.org/sa-contrib-2025-083"],"sources":[{"name":"OSV","id":"DRUPAL-CONTRIB-2025-083","modified":"2026-09-10T03:46:13.130902744Z","url":"https://osv.dev/vulnerability/DRUPAL-CONTRIB-2025-083"}],"assessments":[],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T20:55:31.375Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}