DRUPAL-CONTRIB-2025-107medium6.1
DRUPAL-CONTRIB-2025-107
The advisory, in context
This module integrates Plausible Analytics on a site.
The module did not properly filter output in certain cases.
This vulnerability is mitigated by the fact that an attacker must have permission to add raw HTML to the website, such as an unfiltered WYSIWYG field on a public-facing comment.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
drupal/plausible_tracking Packagist:https://packages.drupal.org/8
Ecosystem versions
Earlier releases before 1.0.2
Fixed in 1.0.2
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.2"
}
],
"type": "ECOSYSTEM",
"database_specific": {
"constraint": "<1.0.2"
}
}
],
"versions": []
}drupal/plausible_tracking Packagist
Ecosystem versions
Earlier releases before 1.0.2
Fixed in 1.0.2
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": []
}