Cross-site Scripting Vulnerability in Drupal ABC
CVE-2026-114525

Currently unrated

Key Information:

Vendor

Drupal
Status
Abc
Vendor
CVE Published:
30 October 2026

What is CVE-2026-114525?

The vulnerability discovered in Drupal ABC allows for stored cross-site scripting (XSS) exploits. This imperfection occurs during web page generation, where user input is not adequately sanitized. Consequently, malicious individuals can inject harmful scripts into pages viewed by other users, potentially compromising sensitive data and undermining user trust. This issue significantly affects various versions of the ABC product, emphasizing the need for immediate updates and rigorous security measures to mitigate risks.

Affected Version(s)

ABC 0.0.0 < 1.25.0

ABC 2.0.0 < 2.0.1

References

https://www.drupal.org/sa-contrib-2026-224

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Drew Webber (mcdruid)
Florian Radut (florian)
Swan Kalata (akalata)
Greg Knaddison (greggles)
Drew Webber (mcdruid)
Juraj Nemec (poker10)
.