CVE-2026-114528

Name of the Vulnerable Software and Affected Versions Drupal Zero Point versions 0.0.0 through 1.30.0 Drupal Zero Point versions 2.0.0 through 2.0.1

Description Stored Cross-site Scripting (XSS) occurs because the theme does not sufficiently sanitize menu link titles before inserting them into HTML class attributes. This issue requires an attacker to have permissions to create or modify menu link titles via menu administration or content menu settings.

Recommendations Update Drupal Zero Point versions 0.0.0 through 1.30.0 to a version newer than 1.30.0. Update Drupal Zero Point versions 2.0.0 through 2.0.1 to a version newer than 2.0.1.