ApostropheCMS versions up to 1.4.2 allow an editor to set the Google Analytics Tracking ID and Google Tag Manager ID directly into a script tag’s body using unsanitized template literals. Because the input is stored in the database and rendered in every page, a malicious value results in stored cross‑site scripting that executes in all visitors’ browsers. The attacker can steal credentials, redirect traffic, or perform other malicious actions on the user’s side. No patched version is available at the time of publication.

The affected product is apostrophecms’s @apostrophecms/seo package. All versions up to and including 1.4.2 are vulnerable. The vulnerability affects any instance where editor‑level users are granted access to edit the seoGoogleTrackingId or seoGoogleTagManager fields.

The CVSS score of 8.7 indicates a high‑severity flaw. The EPSS score is not available, so the likelihood of exploitation cannot be quantified, but the vulnerability is listed as not in the CISA KEV catalog. Attackers would need editor or higher privileges to inject the malicious value, so the primary attack vector is an authenticated, privileged web application input. Once a malicious ID is stored, all site visitors are affected, making this a serious user‑side risk even though it does not compromise the hosting infrastructure directly.