PT-2026-2942 · Drupal+1 · Drupal+1

Published 2026-01-14 · Updated 2026-01-23 · CVE-2025-14557

Positive Technologies (AI Summary)

CVSS v4.0

4.8

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Drupal Facebook Pixel versions 7.X-1.0 through 7.X-1.1

Description The Facebook Pixel module for Drupal contains an Improper Neutralization of Input During Web Page Generation issue, specifically a Stored Cross-site Scripting (XSS) condition. This allows for the injection of malicious scripts. The issue resides within the facebook pixel component.

Recommendations Update Drupal Facebook Pixel to a version later than 7.X-1.1.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-14557

Affected Products

Drupal

Facebook Pixel

References · 6

• 🔥 https://herodevs.com/vulnerability-directory/cve-2025-14557 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-14557 · Security Note
• https://osv.dev/vulnerability/CVE-2025-14557 · Vendor Advisory
• https://d7es.tag1.com/security-advisories/facebook-pixel-less-critical-cross-site-scripting · Note
• https://twitter.com/CVEnew/status/2011555144065069200 · Twitter Post
• https://t.me/cveNotify/149669 · Telegram Post