View online: https://www.drupal.org/sa-contrib-2026-073 Project: Siteimprove Analytics [1] Date: 2026-July-08 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross-site Scripting Affected versions: <2.0.1 CVE IDs: CVE-2026-15082 Description:  The module doesn't sufficiently sanitize the Siteimprove Analytics identification code when inserting the JavaScript tracking code; this could be exploited to achieve Cross-Site Scripting (XSS). This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer siteimprove_analytics". Solution:  Install the latest version: * If you use the siteimprove_analytics module for Drupal verision prior 10.3, upgrade to siteimprove_analytics 2.0.1 [3] Reported By:  * Pierre Rudloff (prudloff) [4] of the Drupal Security Team Fixed By:  * Bohdan Artemchuk (bohart) [5] * Andriy Parkhomiuk (grask0) [6] Coordinated By:  * Greg Knaddison (greggles) [7] of the Drupal Security Team * Pierre Rudloff (prudloff) [8] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/siteimprove_analytics [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/siteimprove_analytics/releases/2.0.1 [4] https://www.drupal.org/u/prudloff [5] https://www.drupal.org/u/bohart [6] https://www.drupal.org/u/grask0 [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/prudloff [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....