CVE-2026-114528 Drupal CVE debrief

Who should care

Drupal administrators and developers using the ZeroPoint theme should assess exposure and prioritize updates to mitigate potential XSS attacks. This includes reviewing specific Drupal configurations and user roles to determine the level of exposure. Defenders should prioritize verifying and updating affected versions of the ZeroPoint theme.

Why it matters

Defenders should prioritize verifying and updating affected versions of the ZeroPoint theme to mitigate potential XSS attacks. Drupal administrators and developers using the ZeroPoint theme should assess exposure based on their specific Drupal configurations and user roles.

• Potential XSS attacks through insufficiently sanitized menu link titles
• Exposure of Drupal websites using affected versions of the ZeroPoint theme
• Need for verification and updates to prevent potential attacks

Technical summary

The ZeroPoint theme for Drupal does not sufficiently sanitize menu link titles before inserting them into HTML class attributes. This vulnerability is mitigated by the requirement that the attacker must be able to create or modify menu link titles, either through menu administration or through content menu settings where permitted. The affected versions are versions less than 1.30.0 or greater than or equal to 2.0.0 and less than 2.0.1. Defenders should prioritize verifying and updating affected versions of the ZeroPoint theme, specifically versions less than 1.30.0 and 2.0.0 to 2.0.1.

Defensive priority

Defenders should prioritize verifying and updating affected versions of the ZeroPoint theme, specifically versions less than 1.30.0 and 2.0.0 to 2.0.1, and assess exposure based on their specific Drupal configurations and user roles.

Recommended defensive actions

• Verify and update affected versions of the ZeroPoint theme
• Assess exposure based on specific Drupal configurations and user roles
• Implement additional sanitization for menu link titles as a compensating control
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is mitigated by the requirement that the attacker must be able to create or modify menu link titles. The affected versions are versions less than 1.30.0 or greater than or equal to 2.0.0 and less than 2.0.1. This information is based on the supplied source corpus and may need verification. Additional review of specific Drupal configurations and user roles is necessary to assess exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.