Menu Link Attributes
Monthly
Stored cross-site scripting in the Drupal contributed module Menu Link Attributes (versions 0.0.0 through 1.8.0) lets an attacker persist a script payload inside a menu link attribute, which then executes in the browser of any user who renders that menu. Exploitation requires an authenticated account holding the Drupal permission to create or edit menu links and set their attributes (PR:H in the CVSS vector), so realistic abuse is limited to insider or compromised-privileged-account scenarios rather than anonymous visitors. Severity is low (CVSS 3.8, EPSS 0.16%, 5th percentile), CISA SSVC records no known exploitation and no automatable path, the project's priority label is monitor, and a vendor patch is available; no public exploit has been identified at time of analysis.
Stored cross-site scripting in the Drupal contributed module Menu Link Attributes (versions 0.0.0 through 1.8.0) lets an attacker persist a script payload inside a menu link attribute, which then executes in the browser of any user who renders that menu. Exploitation requires an authenticated account holding the Drupal permission to create or edit menu links and set their attributes (PR:H in the CVSS vector), so realistic abuse is limited to insider or compromised-privileged-account scenarios rather than anonymous visitors. Severity is low (CVSS 3.8, EPSS 0.16%, 5th percentile), CISA SSVC records no known exploitation and no automatable path, the project's priority label is monitor, and a vendor patch is available; no public exploit has been identified at time of analysis.