CVE-2026-114525

Name of the Vulnerable Software and Affected Versions Drupal ABC versions 0.0.0 through 1.25.0 Drupal ABC versions 2.0.0 through 2.0.1

Description Stored Cross-site Scripting (XSS) occurs because the theme does not sufficiently sanitize menu link titles before inserting them into HTML class attributes. This issue requires an attacker to have permissions to create or modify menu link titles via menu administration or content menu settings.

Recommendations Update Drupal ABC versions 0.0.0 through 1.25.0 to a version newer than 1.25.0. Update Drupal ABC versions 2.0.0 through 2.0.1 to a version newer than 2.0.1.