The Drupal Facebook Pixel module, designed to integrate Facebook analytics into Drupal websites, has a security flaw. This vulnerability, identified as CVE-2025-14557, involves a type of attack called Stored Cross-Site Scripting (XSS). In simple terms, this means that a malicious script could be permanently embedded within the module’s configuration. When someone views the affected configuration, this script could then run in their web browser without their knowledge, potentially leading to unauthorized actions.
The good news is that exploiting this particular vulnerability requires an attacker to have specific administrative privileges on your Drupal site. Specifically, they would need the “Administer Facebook pixel” permission to manipulate the module’s settings. This significantly reduces the immediate risk for most sites, but it’s still a critical issue that needs addressing to protect against insider threats or compromised admin accounts.
CVE Details
This vulnerability impacts the Facebook Pixel module within the Drupal content management system.
- **Product:** Drupal Facebook Pixel
- **Published:** January 14, 2026
- **Severity:** Medium
- **Status:** Analyzed
Affected Products
The Stored XSS vulnerability affects specific versions of the Drupal Facebook Pixel module. If you are using any of these versions, it’s highly recommended to take action:
- Facebook Pixel module versions from 7.X-1.0 through 7.X-1.1.
- This includes any version prior to 7.x-1.2.
Current Status
This vulnerability has been officially analyzed. The details are public, and a fix is available, allowing site administrators and developers to secure their installations.
Severity Level
The Common Vulnerability Scoring System (CVSS) rates this vulnerability with a score of 4.8, classifying it as **Medium** severity. While XSS vulnerabilities can often be severe, the impact here is lessened because an attacker needs administrative access with specific permissions (“Administer Facebook pixel”) to exploit it. This means direct, unauthenticated attacks are not possible. However, if an administrator account is compromised, or if a trusted administrator turns malicious, this vulnerability could be used to inject harmful scripts, leading to defacement, data theft, or other malicious activities within the browser of anyone viewing the affected content.
Possible Solutions
The developers have released an update to address this vulnerability. To protect your Drupal website, the most important step is to **upgrade your Facebook Pixel module immediately**.
Specifically, users of the Drupal 7 Facebook Pixel module should upgrade to **Facebook Pixel 7.x-1.2 or later**. This updated version includes the necessary security fixes to prevent the Stored XSS attacks.
You can typically find the latest stable releases on the official Drupal project page for the module or through the links provided in the security advisory:
- Download facebook_pixel-7.x-1.2.tar.gz
- Download facebook_pixel-7.x-1.2.zip
Regularly updating all modules and core Drupal installations is a fundamental security practice to keep your site safe from known vulnerabilities.
References
https://d7es.tag1.com/security-advisories/facebook-pixel-less-critical-cross-site-scripting
https://www.herodevs.com/vulnerability-directory/cve-2025-14557
