3.8
LowCVSS 3.1 · from CISA
CVE-2026-107306
Menu Link Attributes - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-209
Menu Link Attributes · Cross-site scripting · CWE-79AffectedMenu Link Attributes
FixUpdate to 1.8.0 or newer
PublishedOct 30, 03:10 · drupal
Scored3.8 · CISA
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:09 UTC
What we know
No known exploitation. CISA KEV, checked 22:09 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, high privileges.
Description
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Menu Link Attributes allows Stored XSS. This issue affects Menu Link Attributes versions: from 0.0.0 to 1.8.0.
From drupal
Affected and fixed versions
ProductAffectedFixed inMenu Link Attributes0.0.0 – before 1.8.01.8.0
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known