Drupal Monster Menus CVE-2026-81201

Exploitation requires that the target Drupal site has the Monster Menus module installed and enabled (non-default; it is a contributed, not core, module). The CVSS vector PR:N suggests that no authentication is required to inject the payload, meaning the vulnerable input surface may be accessible to anonymous visitors - however, this should be verified against the full advisory, as stored XSS in Drupal modules more commonly requires at minimum Contributor-level role. Victim-side user interaction is required (UI:R): a legitimate user must browse to a page that renders the poisoned menu output. The scope change (S:C) means the attacker's stored payload executes in a security context (the victim's browser session) different from where the injection occurred. Sites not running Monster Menus are not affected.

The vendor-provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) scores 6.1, classified as Medium. The PR:N metric suggests the injection point may accept anonymous user input, which is plausible for certain Drupal form fields but atypical for stored XSS - this warrants verification against the SA-CONTRIB-2026-116 advisory detail. The scope change (S:C) elevates real-world risk because injected payloads persist and execute for every subsequent visitor, including privileged administrators, enabling session token theft and account takeover chains that exceed what the base score implies. EPSS data is absent from the provided intelligence, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation. No public proof-of-concept code was identified. Real-world prioritization should weight the administrative-privilege escalation path heavily on Drupal sites with publicly accessible content submission.

An attacker - potentially unauthenticated based on the PR:N CVSS metric - submits a crafted payload through a Monster Menus input field (such as a menu label or page attachment form) that is stored in the Drupal database without sanitization. When a site administrator or authenticated user subsequently navigates to a page rendering the affected menu element, the injected script executes in their browser, exfiltrating their session cookie to an attacker-controlled server and enabling full account takeover.