{"id":"CVE-2026-81201","title":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Monster Menus allows Stored XSS","summary":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Monster Menus allows Stored XSS. This issue affects Monster Menus versions: from 0.0.0 to 9.5.3.","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cwe":["CWE-79"],"vendor":"monster_menus_project","product":"monster_menus","affected":["monster_menus >= 6.x-6.19, <= 6.x-6.64","monster_menus >= 7.x-1.0, <= 7.x-1.34","monster_menus >= 9.0.0, < 9.5.3"],"patched":["monster_menus 9.5.3"],"published":"2026-09-02","updated":"2026-09-16","sourceUpdated":"2026-09-16T15:33:32.627","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-81201","references":[{"url":"https://www.drupal.org/sa-contrib-2026-116","label":"mlhess@drupal.org"}],"tags":["nvd"],"epss":0.00256,"epssPercentile":0.1753,"ingestedAt":"2026-09-16T15:58:38.722Z","slug":"CVE-2026-81201","body":"## Overview\n\nImproper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Monster Menus allows Stored XSS. This issue affects Monster Menus versions: from 0.0.0 to 9.5.3.\n\n## Affected\n\n- `monster_menus >= 6.x-6.19, <= 6.x-6.64`\n- `monster_menus >= 7.x-1.0, <= 7.x-1.34`\n- `monster_menus >= 9.0.0, < 9.5.3`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `monster_menus 9.5.3`","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}