{"id":"CVE-2025-14557","aliases":["CLSA-2026-1789632490","EUVD-2026-2429","GHSA-gr4q-4g75-6r32"],"status":"published","title":"XSS in Drupal 7 Facebook Pixel Module","description":"Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Facebook Pixel facebook_pixel allows Stored XSS.This issue affects Facebook Pixel: from 7.X-1.0 through 7.X-1.1.","severity":{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00224,"percentile":0.13126,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2026-01-14T18:40:34Z","modified":"2026-10-28T02:30:35Z","fixes":[{"ecosystem":"TuxCare:Packagist","package":"drupal/facebook_pixel","fixed_in":["7.1.1-p1+tuxcare"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:Packagist","package":"drupal/facebook_pixel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.1.1"},{"fixed":"7.1.1-p1+tuxcare"}]}],"versions":["7.1.1"]}],"products":[{"vendor":"drupal","product":"facebook pixel"},{"vendor":"facebook_pixel_project","product":"facebook_pixel"}],"references":[{"url":"https://www.herodevs.com/vulnerability-directory/cve-2025-14557","tags":["third-party-advisory","Exploit","Third Party Advisory","advisory"]},{"url":"https://d7es.tag1.com/security-advisories/facebook-pixel-less-critical-cross-site-scripting","tags":["third-party-advisory","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-14557","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-gr4q-4g75-6r32"},{"url":"https://git.drupalcode.org/project/facebook_pixel","tags":["web"]},{"url":"https://www.drupal.org/project/facebook_pixel","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/14xxx/CVE-2025-14557.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-14557","title":"XSS in Drupal 7 Facebook Pixel Module","description":"Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Facebook Pixel facebook_pixel allows Stored XSS.This issue affects Facebook Pixel: from 7.X-1.0 through 7.X-1.1.","status":"published","published":"2026-01-14T18:40:34.898Z","modified":"2026-01-14T19:14:30.158Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:32:28.621398Z"}],"euvd":[{"id":"EUVD-2026-2429","description":"Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Facebook Pixel facebook_pixel allows Stored XSS.This issue affects Facebook Pixel: from 7.X-1.0 through 7.X-1.1.","status":"published","published":"2026-01-14T18:40:34Z","modified":"2026-01-14T19:14:30Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"updated_at":"2026-11-02T19:48:51.744142Z"}],"ghsa":[{"id":"GHSA-gr4q-4g75-6r32","title":"Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')...","description":"Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Facebook Pixel facebook_pixel allows Stored XSS.This issue affects Facebook Pixel: from 7.X-1.0 through 7.X-1.1.","status":"published","published":"2026-01-14T21:34:10Z","modified":"2026-01-23T15:32:40Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:05:53.055975Z"}],"nvd":[{"id":"CVE-2025-14557","description":"Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Facebook Pixel facebook_pixel allows Stored XSS.This issue affects Facebook Pixel: from 7.X-1.0 through 7.X-1.1.","status":"published","published":"2026-01-14T19:16:41.55Z","modified":"2026-06-17T08:36:10.047Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:11:57.915063Z"}],"osv":[{"id":"CVE-2025-14557","title":"XSS in Drupal 7 Facebook Pixel Module","description":"Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Facebook Pixel facebook_pixel allows Stored XSS.This issue affects Facebook Pixel: from 7.X-1.0 through 7.X-1.1.","status":"published","published":"2026-01-14T18:40:34.898Z","modified":"2026-10-28T02:30:35.484742729Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:46.340268Z"},{"id":"CLSA-2026-1789632490","title":"TuxCare security update for drupal/facebook_pixel (1 CVE)","description":"TuxCare rebuilt drupal/facebook_pixel to address 1 CVE. Fixed in 7.1.1-p1+tuxcare.","status":"published","published":"2026-09-17T08:08:10Z","modified":"2026-10-15T09:48:00.453873052Z","updated_at":"2026-11-02T15:43:48.28229Z"}]}}