CVE-2025-3130: 
PHP vulnerability analysis and mitigation

A stored Cross-Site Scripting (XSS) vulnerability was discovered in the Drupal Obfuscate module, identified as CVE-2025-3130. The vulnerability affects all versions of Obfuscate from 0.0.0 before version 2.0.1. This security issue was disclosed on April 2, 2025, and involves improper neutralization of input during web page generation (NVD CVE).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The CVSS v3.1 base score is 5.4 (Medium), with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. This indicates that the vulnerability requires low attack complexity, requires low privileges, and needs user interaction to be exploited (NVD CVE).

The stored XSS vulnerability could allow attackers to inject malicious scripts that would be stored on the target system and executed when other users access the affected pages. This could lead to theft of sensitive information, session hijacking, or other malicious actions performed in the context of the affected users' browsers (NVD CVE).

Users are advised to upgrade to Obfuscate version 2.0.1 or later, which contains the fix for this vulnerability. The update addresses the improper input neutralization issue that allowed for the stored XSS attack (Drupal Advisory).