CVE-2025-10927: Plausible tracking - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-107
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Plausible tracking allows Cross-Site Scripting (XSS). This issue affects Plausible tracking: from 0.0.0 before 1.0.2.
Other sources
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Plausible tracking allows Cross-Site Scripting (XSS).This issue affects Plausible tracking: from 0.0.0 before 1.0.2.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/plausible_trackingto a version that resolves this vulnerability.Fixed in 1.0.2
Event History
Frequently Asked Questions
What is the severity of CVE-2025-10927?
CVE-2025-10927 is classified as a high severity vulnerability due to its impact on web security through Cross-Site Scripting (XSS).
How do I fix CVE-2025-10927?
To fix CVE-2025-10927, upgrade the Drupal Plausible tracking module to version 1.0.2 or later immediately.
What systems are affected by CVE-2025-10927?
CVE-2025-10927 affects all versions of Drupal Plausible tracking from 0.0.0 up to, but not including, 1.0.2.
What type of vulnerability is CVE-2025-10927?
CVE-2025-10927 is an improper neutralization of input during web page generation vulnerability known as Cross-Site Scripting (XSS).
Are there any mitigations for CVE-2025-10927?
Currently, the recommended mitigation for CVE-2025-10927 is to apply the necessary software updates to the affected versions of Drupal Plausible tracking.