Unrated severityNVD Advisory· Published Jan 14, 2026· Updated Jan 14, 2026

XSS in Drupal 7 Flag Module

CVE-2025-14556

Description

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Flag allows Cross-Site Scripting (XSS).This issue affects Flag: from 7.X-3.0 through 7.X-3.9.

Affected products

WordPress/Flagllm-fuzzy
Range: >=7.X-3.0, <=7.X-3.9
Package: https://wordpress.org/plugins/flag

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

d7es.tag1.com/security-advisories/flag-moderately-critical-cross-site-scripting-backdrop-sa-contrib-2025-011mitrevendor-advisory
www.herodevs.com/vulnerability-directory/cve-2025-14556mitrevendor-advisory

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000