{"id":"CVE-2026-114525","kind":"vulnerability","aliases":["CVE-2026-114525"],"related":[],"title":"Drupal ABC module: stored cross-site scripting in versions up to 1.25.0","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal ABC allows Stored XSS. This issue affects ABC versions: from 0.0.0 to 1.25.0, from 2.0.0 to 2.0.1.","summary":"The Drupal ABC module has a stored cross-site scripting flaw, so input saved by one user can run as script in other users' browsers. Affected versions are 0.0.0 through 1.25.0 and 2.0.0 through 2.0.1.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","other","web-cms"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check the installed ABC module version on the Drupal site (for example with `drush pm:list` or the Extend page) and compare it against the affected ranges.","fix":"- Versions 1.25.0 and earlier, and 2.0.0 through 2.0.1, are affected; the sources do not name a fixed version.","status":"open","published_at":"2026-10-30T04:18:11+00:00","first_seen_at":"2026-10-30T04:28:36+00:00","triaged_at":"2026-10-30T04:31:13+00:00","updated_at":"2026-10-30T04:31:13+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-30T04:31:13Z","model":"claude-haiku-5-5","output":{"fix":"- Versions 1.25.0 and earlier, and 2.0.0 through 2.0.1, are affected; the sources do not name a fixed version.","reach":"unknown","title":"Drupal ABC module: stored cross-site scripting in versions up to 1.25.0","impact":"medium","summary":"The Drupal ABC module has a stored cross-site scripting flaw, so input saved by one user can run as script in other users' browsers. Affected versions are 0.0.0 through 1.25.0 and 2.0.0 through 2.0.1.","audience":"businesses","category":"other","nicknames":[],"who_cares":["drupal","web-cms"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker script runs in other users' browsers on the site","analyst_note":"Find the vendor or NVD advisory for the fixed ABC version and the affected input field; check the NVD page https://nvd.nist.gov/vuln/detail/CVE-2026-114525.","how_to_check":"- Check the installed ABC module version on the Drupal site (for example with `drush pm:list` or the Extend page) and compare it against the affected ranges.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Sites running the Drupal ABC module in the listed version ranges are exposed. The sources do not describe the specific input field or configuration involved, so unknown whether anonymous users can reach it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000692,"input_tokens":4121,"output_tokens":559,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-114525':16A,19A '-2026':15A,18A '0.0.0':54B,86C '1.25.0':13A,56B,88C '2.0.0':58B,90C '2.0.1':60B,92C 'abc':2A,27B,76C,83C 'affect':51B,82C 'allow':77C 'browser':50B 'cms':24B 'cross':6A,33B,70C 'cross-sit':5A,32B,69C 'cve':14A,17A 'drupal':1A,20B,26B,75C 'flaw':36B 'generat':68C 'improp':61C 'input':38B,64C 'issu':81C 'modul':3A,28B 'neutral':62C 'one':41B 'page':67C 'run':44B 'save':39B 'script':8A,35B,46B,72C 'site':7A,34B,71C 'store':4A,31B,78C 'user':42B,49B 'version':10A,52B,84C 'vulner':73C 'web':23B,66C 'web-cm':22B 'xss':79C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Drupal ABC module in the listed version ranges are exposed. The sources do not describe the specific input field or configuration involved, so unknown whether anonymous users can reach it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:18:11+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114525","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114525","severity":null,"published_at":"2026-10-30T04:18:11+00:00","modified_at":"2026-10-30T04:18:11+00:00","first_seen_at":"2026-10-30T04:28:36+00:00","fetched_at":"2026-10-30T04:28:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}