Description
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Facebook Pixel facebook_pixel allows Stored XSS.This issue affects Facebook Pixel: from 7.X-1.0 through 7.X-1.1.
References (2)
Core 2
Core References
Exploit, Third Party Advisory third-party-advisory
https://www.herodevs.com/vulnerability-directory/cve-2025-14557
Third Party Advisory third-party-advisory
https://d7es.tag1.com/security-advisories/facebook-pixel-less-critical-cross-site-scripting
Scores
CVSS v3
4.8
EPSS
0.0019
EPSS Percentile
8.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-79
Status
published
Products (1)
facebook_pixel_project/facebook_pixel
7.x-1.0 - 7.x-1.1
Published
Jan 14, 2026
Tracked Since
Feb 18, 2026