| Package | Affected versions | Patched versions |
|---|---|---|
| drupal/colorbox_inline | < 2.1.1 | 2.1.1 |
| colorbox inline | < 2.1.1 | 2.1.1 |
This module enables you to open content already on the page within a colorbox.
The module doesn't sufficiently sanitize the data-colorbox-inline attribute value before passing it to jQuery, leading to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free