Live › vulnerability › CVE-2026-107306
The Drupal Menu Link Attributes module does not neutralize input when generating web pages, enabling stored cross-site scripting. An attacker who can store crafted menu link attribute values can run scripts in other users' browsers.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Sites running the Drupal Menu Link Attributes module in the affected version range. Exposure depends on who can edit menu link attributes and whether those values are rendered to other visitors. Sites without the module can skip it.
No product ranges from the sources yet.
drush pm:list --filter=menu_link_attributes1.8.0 are outside the affected range; the sources do not name a specific fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Menu Link Attributes allows Stored XSS. This issue affects Menu Link Attributes versions: from 0.0.0 to 1.8.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-107306")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.