Is CVE-2026-81201 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-81201 being exploited in the wild.

How severe is CVE-2026-81201?

Medium severity, with a CVSS score of 6.1, published 2 September 2026.

Which products and versions are affected?

Packagist:Https://Packages.Drupal.Org/8 Drupal/Monster Menus ECOSYSTEM:introduced=0,fixed=9.5.3.

Is there a fix for CVE-2026-81201?

Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Monster Menus: upgrade to 9.5.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-81201 attacked?

It is attacked over the network.

Am I affected by CVE-2026-81201?

Check whether you run Packagist:Https://Packages.Drupal.Org/8 Drupal/Monster Menus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-81201: Drupal Monster Menus stored cross-site scripting in page titles

CVE-2026-81201 · Severity: medium · CVSS 6.1 · Published 2026-09-02

Monster Menus is a Drupal module that manages hierarchical page structures with granular permissions. The module fails to sanitize HTML in page titles when displayed in the tree browser, allowing attackers with page creation permissions to inject and execute arbitrary JavaScript in other users' sessions, potentially compromising accounts or stealing sensitive data.

Technologies: Packagist:Https://Packages.Drupal.Org/8 Drupal/Monster Menus. Vendors: Packagist:Https://Packages.Drupal.Org/8.

Quick answers

Is CVE-2026-81201 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-81201 being exploited in the wild.
How severe is CVE-2026-81201?: Medium severity, with a CVSS score of 6.1, published 2 September 2026.
Which products and versions are affected?: Packagist:Https://Packages.Drupal.Org/8 Drupal/Monster Menus ECOSYSTEM:introduced=0,fixed=9.5.3.
Is there a fix for CVE-2026-81201?: Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Monster Menus: upgrade to 9.5.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-81201 attacked?: It is attacked over the network.
Am I affected by CVE-2026-81201?: Check whether you run Packagist:Https://Packages.Drupal.Org/8 Drupal/Monster Menus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Packagist:Https://Packages.Drupal.Org/8 Drupal/Monster Menus: upgrade to 9.5.3 or later

Technical details

This is a stored cross-site scripting (XSS) vulnerability in the Monster Menus Drupal module affecting versions before 9.5.3. The vulnerability exists in the tree browser component, which displays page names without proper HTML sanitization. An attacker with the ability to create or edit pages can inject malicious HTML and JavaScript into page titles. When other users view the tree browser, the injected script executes in their browser within the context of their authenticated session. This allows attackers to steal session tokens, redirect users, or perform actions on behalf of victims. The attack requires attackers to possess page creation/editing privileges, limiting the threat to authenticated users with moderate permissions.

Affected products

Drupal Monster Menus before 9.5.3

Identifiers

CVE-2026-81201
DRUPAL-CONTRIB-2026-116

Timeline

2026-08-26: disclosed
2026-08-27: patched: Version 9.5.3 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.