CVE-2019-19901

CVE-2019-19901 describes a stored Cross-Site Scripting (XSS) vulnerability in Backdrop CMS versions 1.13.x before 1.13.5 and 1.14.x before 1.14.2. This flaw allows an attacker with administrative privileges to craft malicious block descriptions, which would then execute scripting in an administrator's browser when configuring a layout. The vulnerability carries a CVSS score of 4.8 (Medium), indicating a low-impact issue requiring high privileges and user interaction for exploitation. While an attacker needs administrative access to create custom blocks, successful exploitation could lead to limited data compromise (C:L) and integrity impact (I:L). There is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage for this CVE are minimal, consistent with the majority of reported vulnerabilities.