CVSS base score
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Google Analytics GA4 allows Cross-Site Scripting (XSS).This issue affects Google Analytics GA4: from 0.0.0 before 1.1.14.
Explanation of Vulnerability in Simple Terms
The Google Analytics GA4 module for Drupal contains a cross-site scripting (XSS) vulnerability in versions before 1.1.14. An attacker can inject malicious scripts that execute in the browsers of site visitors or administrators. The vulnerability exists in how the module processes or displays user-controlled input without proper sanitization.
What an attacker can do
Inject malicious JavaScript that runs in visitors' browsers, potentially stealing session tokens or redirecting users.
Potential impact on your site
Visitors and admins may have their sessions hijacked or be redirected to malicious sites when viewing affected pages.
Conditions required to exploit
Ability to control input that the module displays (exact method unknown due to missing CVSS details).
Key dates
External resources
Related vulnerabilities
