CVE-2025-14557

Medium · 4.8

CVSS

4.8

EPSS

0.2%

Published

Jan 14, 2026

CISA due date

—

The record

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Facebook Pixel facebook_pixel allows Stored XSS.This issue affects Facebook Pixel: from 7.X-1.0 through 7.X-1.1.

Affected packages

Ecosystem	Package	Introduced	Fixed