CVE-2026-107306: Menu Link Attributes - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-209

Published Oct 30, 2026

Updated

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Menu Link Attributes allows Stored XSS. This issue affects Menu Link Attributes versions: from 0.0.0 to 1.8.0.

Event History

Oct 30, 2026

CVE Published

via MITRE·03:10 AM

Data Sourced

via MITRE·03:10 AM

DescriptionWeakness

Data Sourced

via NVD·04:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Drupal sites using Menu Link Attributes versions from 0.0.0 through 1.8.0 are affected.

What level of access does an attacker need?

The CVSS vector indicates that exploitation requires high privileges. The issue is remotely reachable, requires no user interaction, and has low impact on confidentiality and integrity.

CVE-2026-107306: Menu Link Attributes - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-209

Event History

Frequently Asked Questions

Which deployments are affected?

What level of access does an attacker need?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What level of access does an attacker need?