CVE-2025-14556

Medium · 5.4

CVSS

5.4

EPSS

0.2%

Published

Jan 14, 2026

CISA due date

—

The record

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Flag allows Cross-Site Scripting (XSS).This issue affects Flag: from 7.X-3.0 through 7.X-3.9.

Affected packages

Ecosystem	Package	Introduced	Fixed