Google Analytics Ga4 EUVD-2026-16383

While a CVSS score and vector are not provided, the vulnerability is characterized as CWE-79 (XSS), which typically permits remote exploitation without authentication. The affected version range (0.0.0 to <1.1.14) spans all releases of this module prior to the patched version, suggesting broad exposure for installations that have not been updated. No CVSS severity, EPSS score, or CISA KEV listing is available in the provided data, limiting quantitative risk scoring; however, XSS vulnerabilities in analytics modules are generally considered moderate to high risk because they affect all site visitors and can be used for credential theft, malware distribution, or account compromise. The presence of a vendor-released patch (version 1.1.14) indicates the issue was actively addressed by the Drupal security team. No public exploit code has been identified, and no active exploitation has been confirmed at the time of analysis. The real-world priority depends on site traffic volume and whether the vulnerability is reliably exploitable without additional preconditions; organizations running vulnerable versions should prioritize patching to eliminate XSS exposure.

An attacker could inject malicious JavaScript into a GA4 configuration parameter, custom event name, or URL parameter that the vulnerable module processes and reflects in the page HTML without escaping. For example, a crafted URL containing a payload like ?event=<script>alert(document.cookie)</script> could execute arbitrary JavaScript when a site administrator or visitor loads the page. This payload would execute in every user's browser session that views the affected page, enabling session hijacking, credential theft, or redirection to phishing sites. No public proof-of-concept code has been identified, but the attack vector requires only network access and knowledge of the module's input fields.