Advisory ID: 
Cross Site Scripting
Versions affected: 
  • Backdrop Core 1.x.x versions prior to 1.11.1

Backdrop CMS doesn't sufficiently protect against XSS when allowing administrative users to define custom classes for blocks and regions. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Administer Layouts".


Upgrade your site to the most recent version of Backdrop core.  Download available on the Backdrop CMS 1.11.1 release page.  See the update instructions, if needed.

Reported By: 
Fixed By: 
Coordinated By: