{"id":"CVE-2025-10927","aliases":["DRUPAL-CONTRIB-2025-107","EUVD-2025-36879","GHSA-pr6m-qwrr-mrw9"],"status":"published","title":"Plausible tracking - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-107","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Plausible tracking allows Cross-Site Scripting (XSS).This issue affects Plausible tracking: from 0.0.0 before 1.0.2.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00194,"percentile":0.09235,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2025-09-24T17:18:08Z","modified":"2026-10-28T02:30:52Z","fixes":[{"ecosystem":"Packagist","package":"drupal/plausible_tracking","fixed_in":["1.0.2"],"sources":["ghsa","osv"]},{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/plausible_tracking","fixed_in":["1.0.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"drupal/plausible_tracking","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2"}]}]},{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/plausible_tracking","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2"}]}]},{"source":"osv","ecosystem":"Packagist","package":"drupal/plausible_tracking","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2"}]}]}],"products":[{"vendor":"drupal","product":"plausible tracking"},{"vendor":"plausible_tracking_project","product":"plausible_tracking"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2025-107","tags":["Patch","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-10927","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-pr6m-qwrr-mrw9"},{"url":"https://git.drupalcode.org/project/plausible_tracking","tags":["web"]},{"url":"https://www.drupal.org/project/plausible_tracking","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/10xxx/CVE-2025-10927.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-10927","title":"Plausible tracking - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-107","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Plausible tracking allows Cross-Site Scripting (XSS).This issue affects Plausible tracking: from 0.0.0 before 1.0.2.","status":"published","published":"2025-10-29T23:13:12.338Z","modified":"2025-10-30T14:42:43.207Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:32:30.643267Z"}],"euvd":[{"id":"EUVD-2025-36879","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Plausible tracking allows Cross-Site Scripting (XSS).This issue affects Plausible tracking: from 0.0.0 before 1.0.2.","status":"published","published":"2025-10-29T23:13:12Z","modified":"2025-10-30T14:42:43Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:49:36.236088Z"}],"ghsa":[{"id":"GHSA-pr6m-qwrr-mrw9","title":"Drupal Plausible tracking is vulnerable to XSS","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Plausible tracking allows Cross-Site Scripting (XSS). This issue affects Plausible tracking: from 0.0.0 before 1.0.2.","status":"published","published":"2025-10-30T00:31:03Z","modified":"2025-10-30T17:10:59Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:39:04.350802Z"}],"nvd":[{"id":"CVE-2025-10927","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Plausible tracking allows Cross-Site Scripting (XSS).This issue affects Plausible tracking: from 0.0.0 before 1.0.2.","status":"published","published":"2025-10-30T00:15:33.953Z","modified":"2026-10-08T10:10:00.227Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:11:41.607433Z"}],"osv":[{"id":"CVE-2025-10927","title":"Plausible tracking - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-107","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Plausible tracking allows Cross-Site Scripting (XSS).This issue affects Plausible tracking: from 0.0.0 before 1.0.2.","status":"published","published":"2025-10-29T23:13:12.338Z","modified":"2026-10-28T02:30:52.470335612Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:45.712478Z"},{"id":"GHSA-pr6m-qwrr-mrw9","title":"Drupal Plausible tracking is vulnerable to XSS","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Plausible tracking allows Cross-Site Scripting (XSS). This issue affects Plausible tracking: from 0.0.0 before 1.0.2.","status":"published","published":"2025-10-30T00:31:03Z","modified":"2025-12-10T23:40:56.168934Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:53.700556Z"},{"id":"DRUPAL-CONTRIB-2025-107","description":"This module integrates Plausible Analytics on a site.\n\nThe module did not properly filter output in certain cases.\n\nThis vulnerability is mitigated by the fact that an attacker must have permission to add raw HTML to the website, such as an unfiltered WYSIWYG field on a public-facing comment.","status":"published","published":"2025-09-24T17:18:08Z","modified":"2026-09-10T03:45:15.020864326Z","updated_at":"2026-11-02T15:46:13.900249Z"}]}}