Plausible Tracking
Monthly
Cross-site scripting in the Drupal 'Plausible tracking' contributed module (versions from 0.0.0 before 1.0.2) lets injected input be rendered into a page without adequate escaping, so a crafted payload executes in the browser of a user who loads the affected page or link. The vulnerability requires victim user interaction (UI:R) and its authentication prerequisites are not confirmed from the available data, as the vendor vector indicates PR:N while our independent assessment rates PR:L and the exact unsanitized field is not identified. Impact is bounded (low confidentiality and integrity, no availability effect), EPSS is only 0.19% (8th percentile), no public exploit code has been identified at time of analysis, and a fix is available in version 1.0.2.
Cross-site scripting in the Drupal 'Plausible tracking' contributed module (versions from 0.0.0 before 1.0.2) lets injected input be rendered into a page without adequate escaping, so a crafted payload executes in the browser of a user who loads the affected page or link. The vulnerability requires victim user interaction (UI:R) and its authentication prerequisites are not confirmed from the available data, as the vendor vector indicates PR:N while our independent assessment rates PR:L and the exact unsanitized field is not identified. Impact is bounded (low confidentiality and integrity, no availability effect), EPSS is only 0.19% (8th percentile), no public exploit code has been identified at time of analysis, and a fix is available in version 1.0.2.