Easy Breadcrumb - Moderately critical - Cross site scripting - SA-CONTRIB-2020-027
Project: Easy Breadcrumb Version: 8.x-1.x-dev Date: 2020-July-22 Security risk: Moderately critical 13∕25 Vulnerability: Cross site scripting
This module enables you to use the current URL (path alias) and the current page's title to automatically extract the breadcrumb's segments and its respective links then show them as breadcrumbs on your website.
The module doesn't sufficiently sanitize editor input in certain circumstances leading to a Cross Site Scripting (XSS) vulnerability.
This vulnerability requires the user have 'administer Easy Breadcrumb settings permission'.
Install the latest version:
If you use the Easy Breadcrumb module for Drupal 8, upgrade to Easy Breadcrumb 8.x-1.13
Also see the Easy Breadcrumb project page.