Plausible tracking - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-107

Vulnerability

Analysis

CVE-2025-10927 describes a stored cross-site scripting (XSS) vulnerability in the Drupal Plausible tracking module. The flaw arises from improper neutralization of user input during web page generation, specifically because the module does not sanitize output in certain scenarios when rendering data from the Plausible Analytics integration [2].

Exploitation

Prerequisites

An attacker must have the ability to add raw HTML to the Drupal website, such as through an unfiltered WYSIWYG field on a public-facing comment form. This privilege requirement mitigates the severity, as not all users can inject content [2]. The exploitation is network-based and requires no authentication beyond the necessary permissions.

Impact

If successful, the attacker can execute arbitrary JavaScript in the context of a victim's browser session. This can lead to data theft, session hijacking, defacement, or redirection to malicious sites. The CVSS v4.0 vector is not yet provided by NIST [1], but the Drupal security advisory rates this as "Moderately critical" [2].

Mitigation

The vulnerability is fixed in version 1.0.2 of the Plausible tracking module. Users are strongly advised to update immediately. There is no evidence this issue is exploited in the wild, and no workaround is documented apart from applying the patch [1][2].