PT-2026-107760

CVE-2026-107306

Published

2026-10-07

Updated

2026-10-30

Description by

CVSS 3.1

3.8

Low

MetricsAV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Drupal Menu Link Attributes versions 0.0.0 through 1.8.0

Description Stored Cross-site Scripting (XSS) occurs because the module does not sufficiently sanitize attributes applied to menu link container elements. This issue requires an attacker to possess the "Administer menus and menu links" and "Use menu link attributes" permissions. Additionally, an unsafe container attribute must have been previously configured by a user with the "Administer menu link attributes" permission. The default configuration is not affected.

Recommendations Update Drupal Menu Link Attributes to a version later than 1.8.0.

Exploitability

Fix

Impacts

Researchers

Vendors