CVE-2026-81201

MediumCVSS 6.1

Published: 02/09/2026(UTC)Updated: 16/09/2026(UTC)Translated: 02/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

17th percentile - higher than 17% of all known CVEs

Summary

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Monster Menus allows Stored XSS. This issue affects Monster Menus versions from 0.0.0 to 9.5.3.

Risk Assessment

An attacker can inject a persistent script that executes in users' browsers, potentially leading to session theft or other malicious actions.

Recommendation

Update the Monster Menus module to a version above 9.5.3 and review content for malicious code.

Other vulnerabilities in Drupal Monster Menus

CVE-2026-114573Low risk· EPSS 16%
The vulnerability in the Drupal Monster Menus module involves improperly controlled modification of dynamically-determined object attributes, allowing Object Injection. This issue affects versions from 0.0.0 to 9.5.6.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS