CVE-2025-14557
This Vulnerability has been fixed in the Never-Ending Support (NES) version offered by HeroDevs.
Overview
Drupal is an open-source content management system known for its flexibility, robust features, and strong community support. Organizations of all sizes use it to build and manage dynamic websites and web applications.
The Facebook Pixel module places a pixel across pages to report actions to Facebook for tracking and reporting purposes. Users with access to the configuration form are able to submit XSS-susceptible code.
A cross-site scripting (XSS) vulnerability is a type of security flaw that allows attackers to inject malicious scripts into webpages. It often occurs when a site fails to properly validate or sanitize user input, enabling the execution of unauthorized code within a victim's browser. It is included in the OWASP Top Ten list of vulnerabilities, specifically in the third category of Injection. A web site compromised in this way may experience:
- Session hijacking
- Data theft
- Malware distribution
- Defacement or phishing and
- Privilege escalation.
This issue affects Drupal Facebook Pixel versions 7.0.0 up to and including 7.1.1.
Details
Module Info
- Product: Drupal
- Affected code: Facebook Pixel module
- Affected versions: <=7.1.1
- Project page: https://drupal.org/project/facebook_pixel
- Fixed in: Facebook Pixel NES 7.1.2
Vulnerability Info
The module automatically places the Facebook Pixel code on every page of your website, usually in the <head> section of the page’s HTML.
This high-severity vulnerability is found in the Facebook Pixel module in versions greater than 7.0.0 and less than or equal to 7.1.1.
Addressing the Issue
Users of the affected components should apply one of the following:
- Disable the Facebook Pixel module.
- Restrict input to just numbers (the format of a Facebook ID).
- Add sanitization to the input upon form submission.
- Sign up for post-EOL security support; HeroDevs customers get immediate access to a patched version of this module.
Credits
Ivo Van Geertruyen (mr.baileys)
