Siteimprove Analytics CVE-2026-15082

Exploitation requires the attacker to hold a valid, authenticated Drupal account with at least low-level permissions (confirmed by CVSS PR:L). The Siteimprove Analytics contributed module must be installed and enabled on the target Drupal instance - default Drupal installations without this module are not affected. A second victim user - most likely an administrator or editor - must visit or interact with the page rendering the attacker's injected payload (CVSS UI:R). Exploitation is limited by three concrete prerequisites: prior account access to the Drupal site, presence of the specific contributed module, and victim interaction. Sites that restrict user registration to vetted individuals or that disable public account creation significantly reduce the practical attack surface beyond what the raw CVSS score implies.

The CVSS 5.4 Medium score reflects meaningful but bounded risk: the attack requires prior authentication (PR:L) and victim user interaction (UI:R), limiting opportunistic mass exploitation. The scope change (S:C) is what elevates the score, as XSS payloads can hijack admin sessions or exfiltrate credentials beyond the original attacker's privilege level. EPSS at 0.19% (8th percentile) strongly corroborates low real-world targeting; the vulnerability is absent from CISA KEV and no public exploit code has been identified. Practical risk depends heavily on the Drupal site's user registration policy: open-registration sites face a more accessible attack path since any registered account suffices, while sites restricting account creation to trusted users face meaningfully reduced exposure. The niche footprint of the Siteimprove Analytics module further narrows the affected population. This is a patch-when-possible rather than emergency-response priority for most organizations.

An authenticated Drupal user with a low-privilege account submits a crafted payload containing malicious JavaScript through an input field or configuration surface handled by the Siteimprove Analytics module. When an administrator or editor later navigates to the page that renders the tainted content, the injected script executes silently in their browser, potentially exfiltrating the admin's session cookie to an attacker-controlled endpoint or performing privileged CMS actions on their behalf. No public exploit code has been identified, reducing the likelihood of unsophisticated threat actors exploiting this vulnerability in the near term.