Drupal Plausible Tracking CVE-2025-10927

Exploitation targets the Drupal 'Plausible tracking' contrib module at versions from 0.0.0 up to (but not including) 1.0.2; the site must have this module installed and enabled. Successful attack requires victim user interaction (UI:R) - the target must load the page or link carrying the unsanitized input that the module renders. The provided data does not identify the exact unsanitized field, so whether injecting the payload needs administrative/authenticated access to the module's configuration (vendor rates PR:N) is not confirmed. Limiting factors: required user interaction, the narrow deployment base of this specific module, and the fix being available in 1.0.2+.

Signals point consistently toward a moderate, low-urgency issue rather than a top priority. The CVSS 3.1 base score is 6.1 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - network-reachable and low-complexity, but requiring victim user interaction (UI:R) and yielding only limited confidentiality/integrity impact with no availability impact, consistent with a cross-site scripting (CWE-79) flaw. EPSS reinforces low real-world threat: 0.19% probability at the 8th percentile. The vulnerability is NOT in CISA KEV and no public exploit code is referenced, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was provided in the input. One tension to verify: the vendor vector lists PR:N (unauthenticated), but XSS in an analytics-integration module is often introduced through a configuration/site field that only an authenticated administrator can set, which would argue for PR:L - this should be confirmed against the Drupal advisory. Overall this is a genuine but routine Medium-severity web flaw in a niche Drupal contrib module; patch during normal maintenance rather than emergency remediation.

An attacker causes a victim's browser to render attacker-controlled input that the Plausible tracking module emits into a web page without proper neutralization, executing script in the victim's session (UI:R means the victim must load the affected page or follow a crafted link). Because scope is changed (S:C), the injected script runs in the context of site visitors and can perform actions such as session/cookie theft or request forgery. No public exploit code is referenced, so exploitation would require an attacker to develop the payload against the specific injection point.