Cross-site Scripting Vulnerability in Drupal Menu Link Attributes Plugin
CVE-2026-107306

Currently unrated

Key Information:

Vendor

Drupal
Status
Menu Link Attributes
Vendor
CVE Published:
30 October 2026

What is CVE-2026-107306?

An issue has been identified in the Drupal Menu Link Attributes plugin that allows for improper neutralization of input during web page generation, leading to a Stored XSS vulnerability. This security flaw can enable attackers to inject malicious scripts into the web application, potentially compromising user data and web integrity. Affected users are advised to update their installations to prevent exploitation.

Affected Version(s)

Menu Link Attributes 0.0.0 < 1.8.0

References

https://www.drupal.org/sa-contrib-2026-209

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Marcus Johansson (marcus_johansson)
Joshua Sedler (grevil)
Marcus Johansson (marcus_johansson)
Yannick (yannickoo)
Swan Kalata (akalata)
Greg Knaddison (greggles)
Juraj Nemec (poker10)
.