—
DRUPAL-CONTRIB-2025-058
Details
This module enables you to add the Piwik Pro web statistics tracking system to your website.
The module does not check the JS code that is loaded on the website. So a user with the "Administer Piwik Pro" permission could configure the module to load JS from a malicious website.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer piwik pro" to access the settings form where this can be configured.
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist:https://packages.drupal.org/8/drupal/piwik_pro
Introduced in:
0Fixed in: 1.3.2Upgrade drupal/piwik_pro to 1.3.2 or newer (ecosystem packagist:https://packages.drupal.org/8).