Description
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Monster Menus allows Stored XSS. This issue affects Monster Menus versions: from 0.0.0 to 9.5.3.
Published: 2026-09-02
Score: 6.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Stored Cross‑Site Scripting
Action: Patch
AI Analysis

Impact

The Drupal Monster Menus module contains a stored cross‑site scripting flaw that permits attackers to inject JavaScript into menu entries. Classified as CWE‑79, the vulnerability causes arbitrary script execution in the context of any user who views the affected menu. The malicious code is stored and served with every page load.

Affected Systems

All installations of Drupal’s Monster Menus module from version 0.0.0 through 9.5.3 are affected. Any site using these versions without an update should be considered vulnerable.

Risk and Exploitability

The flaw is exploitable remotely by submitting crafted input into menu fields; the malicious content is stored and later served to visitors, allowing repeated exploitation without additional interaction. CVSS score 6.1 indicates moderate severity. EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The stored XSS nature means that any user who views the affected menu will have the malicious script executed in their browser.

Generated by OpenCVE AI on September 3, 2026 at 13:47 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Monster Menus to a version newer than 9.5.3 once a patch is released by the vendor.
  • If an upgrade cannot be performed immediately, sanitize user‑supplied menu content by escaping or stripping script tags before storage.
  • Continuously scan existing menus for embedded scripts, remove any malicious payloads, and monitor traffic for signs of XSS exploitation.

Generated by OpenCVE AI on September 3, 2026 at 13:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://www.drupal.org/sa-contrib-2026-116 cve-icon cve-icon
History

Wed, 16 Sep 2026 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Monster Menus Project
Monster Menus Project monster Menus
CPEs cpe:2.3:a:monster_menus_project:monster_menus:*:*:*:*:*:drupal:*:*
Vendors & Products Monster Menus Project
Monster Menus Project monster Menus

Thu, 03 Sep 2026 08:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 02 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

Wed, 02 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
First Time appeared Drupal
Drupal monster Menus
Vendors & Products Drupal
Drupal monster Menus

Wed, 02 Sep 2026 12:45:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Monster Menus allows Stored XSS. This issue affects Monster Menus versions: from 0.0.0 to 9.5.3.
Title Monster Menus - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-116
Weaknesses CWE-79
References

Subscriptions

Drupal Monster Menus
Monster Menus Project Monster Menus
cve-icon MITRE

Status: PUBLISHED

Assigner: drupal

Published:

Updated: 2026-09-02T17:50:31.054Z

Reserved: 2026-08-26T16:35:19.084Z

Link: CVE-2026-81201

cve-icon Vulnrichment

Updated: 2026-09-02T17:50:27.573Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-02T13:18:12.700

Modified: 2026-09-16T15:33:32.627

Link: CVE-2026-81201

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-03T14:00:04Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')