Executive brief
Siteimprove Analytics is a Drupal module used to integrate website tracking and analytics services. A security vulnerability exists where the module fails to properly clean the analytics identification code before displaying it on the site. If an attacker with administrative access provides a malicious code snippet, they could execute unauthorized scripts in the browsers of other users, potentially leading to unauthorized actions or data access.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in the Drupal Siteimprove Analytics module (versions prior to 2.0.1). The root cause is the improper neutralization of input during web page generation, specifically regarding the Siteimprove Analytics identification code. An attacker with 'administer siteimprove_analytics' permissions can inject malicious JavaScript into the configuration field, which is then rendered without sufficient sanitization when the tracking code is inserted into pages. This allows for the execution of arbitrary script in the context of a user's browser session. The issue is fixed in version 2.0.1.
Affected products
- Drupal Siteimprove Analytics 0.0.0 to 2.0.0
Timeline
- 2026-07-08: patched: Version 2.0.1 released to address the vulnerability.
- 2026-07-08: advisory: Drupal Security Advisory SA-CONTRIB-2026-073 published.
- 2026-07-10: disclosed: CVE-2026-15082 published to the NVD.