{"id":"CVE-2026-114528","kind":"vulnerability","aliases":["CVE-2026-114528"],"related":[],"title":"Drupal Zero Point theme: stored XSS lets attackers run scripts in pages","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Zero Point allows Stored XSS. This issue affects Zero Point versions: from 0.0.0 to 1.30.0, from 2.0.0 to 2.0.1.","summary":"Drupal Zero Point, a Drupal theme, has a stored cross-site scripting flaw in which user-supplied input is not neutralized when web pages are generated. An attacker who can submit that input can get malicious scripts saved and run in other visitors' browsers.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","other","php","web-cms"],"not_affected_if":[],"how_to_check":"- Check the installed Zero Point version in the Drupal project (for example with `drush pm:list` or the composer lock file) and compare it against the affected ranges.","fix":"- Zero Point versions from `0.0.0` to `1.30.0` and from `2.0.0` to `2.0.1` are affected; the sources do not state a fixed version.","status":"open","published_at":"2026-10-30T04:18:11+00:00","first_seen_at":"2026-10-30T04:28:37+00:00","triaged_at":"2026-10-30T04:31:09+00:00","updated_at":"2026-10-30T04:31:09+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-30T04:31:09Z","model":"claude-haiku-5-5","output":{"fix":"- Zero Point versions from `0.0.0` to `1.30.0` and from `2.0.0` to `2.0.1` are affected; the sources do not state a fixed version.","reach":"internet","title":"Drupal Zero Point theme: stored XSS lets attackers run scripts in pages","impact":"medium","summary":"Drupal Zero Point, a Drupal theme, has a stored cross-site scripting flaw in which user-supplied input is not neutralized when web pages are generated. An attacker who can submit that input can get malicious scripts saved and run in other visitors' browsers.","audience":"businesses","category":"other","nicknames":[],"who_cares":["drupal","web-cms","php"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker scripts run in visitors' browsers and steal sessions","analyst_note":"Check the Drupal security advisory for Zero Point to confirm the fixed version, required permissions and whether the input is submitted by anonymous users.","how_to_check":"- Check the installed Zero Point version in the Drupal project (for example with `drush pm:list` or the composer lock file) and compare it against the affected ranges.\n- Unknown whether other checks apply; the sources do not say.","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Sites running the Drupal Zero Point theme in the affected version ranges are exposed, since the flaw is stored XSS on pages built with it. The sources do not say which configurations or roles are needed, so unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000703,"input_tokens":4125,"output_tokens":581,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-114528':15A,18A '-2026':14A,17A '0.0.0':98C '1.30.0':100C '2.0.0':102C '2.0.1':104C 'affect':93C 'allow':88C 'attack':8A,54B 'browser':70B 'cms':24B 'cross':35B,80C 'cross-sit':34B,79C 'cve':13A,16A 'drupal':1A,19B,25B,29B,85C 'flaw':38B 'generat':52B,78C 'get':61B 'improp':71C 'input':44B,59B,74C 'issu':92C 'let':7A 'malici':62B 'neutral':47B,72C 'page':12A,50B,77C 'php':21B 'point':3A,27B,87C,95C 'run':9A,66B 'save':64B 'script':10A,37B,63B,82C 'site':36B,81C 'store':5A,33B,89C 'submit':57B 'suppli':43B 'theme':4A,30B 'user':42B 'user-suppli':41B 'version':96C 'visitor':69B 'vulner':83C 'web':23B,49B,76C 'web-cm':22B 'xss':6A,90C 'zero':2A,26B,86C,94C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Drupal Zero Point theme in the affected version ranges are exposed, since the flaw is stored XSS on pages built with it. The sources do not say which configurations or roles are needed, so unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:18:11+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114528","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114528","severity":null,"published_at":"2026-10-30T04:18:11+00:00","modified_at":"2026-10-30T04:18:11+00:00","first_seen_at":"2026-10-30T04:28:37+00:00","fetched_at":"2026-10-30T04:28:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}