CVE-2026-114526

Name of the Vulnerable Software and Affected Versions Drupal Black Hole versions 0.0.0 through 1.26.0 Drupal Black Hole versions 2.0.0 through 2.0.1

Description Stored Cross-site Scripting (XSS) occurs because the theme does not sufficiently sanitize menu link titles before inserting them into HTML class attributes. This issue allows an attacker who can create or modify menu link titles, via menu administration or permitted content menu settings, to execute malicious scripts in the context of the user's session.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.