CVE-2026-114525 drupal CVE debrief

Who should care

Drupal users who have the ABC theme installed and have users who can create or modify menu link titles should assess their exposure and prioritize verification and updates. Defenders should prioritize verifying and updating the ABC theme to a fixed version, especially if the organization uses Drupal and has users who can create or modify menu link titles. Security teams should review compensating controls for exposed systems while remediation is scheduled.

Why it matters

The ABC theme for Drupal has a vulnerability that allows for potential XSS attacks if an attacker can create or modify menu link titles. Defenders should prioritize verifying and updating the theme to a fixed version.

• Verify and update the ABC theme to a fixed version to prevent potential XSS attacks
• Restrict access to menu administration and content menu settings to reduce the attack surface
• Monitor for suspicious activity related to menu link titles to detect potential exploitation attempts

Technical summary

The ABC theme provides configurable layouts and visual styling for Drupal websites, including support for Font Awesome icons in navigation menus. The theme does not sufficiently sanitize menu link titles before inserting them into HTML class attributes. This vulnerability allows for potential XSS attacks if an attacker can create or modify menu link titles. The affected versions are <1.25.0 || >=2.0.0 <2.0.1. Defenders should prioritize verifying and updating the ABC theme to a fixed version, especially if the organization uses Drupal and has users who can create or modify menu link titles.

Defensive priority

Defenders should prioritize verifying and updating the ABC theme to a fixed version, especially if the organization uses Drupal and has users who can create or modify menu link titles.

Recommended defensive actions

• Verify and update the ABC theme to a fixed version
• Restrict access to menu administration and content menu settings
• Monitor for suspicious activity related to menu link titles
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is mitigated by the requirement that the attacker must be able to create or modify menu link titles. The affected versions are <1.25.0 || >=2.0.0 <2.0.1. The source item provides details about the vulnerability, and the CVE record was published on 2026-10-21T17:38:41.000Z. Defenders should verify the affected scope and review compensating controls for exposed systems.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.