The ABC theme provides configurable layouts and visual styling for Drupal websites, including support for Font Awesome icons in navigation menus. (CVE-2026-114525)

The ABC theme for Drupal enables configurable layouts and visual styling, including Font Awesome icon support in navigation menus. It suffers from insufficient sanitization of menu link titles before insertion into HTML class attributes, potentially allowing injection of unsafe content. Exploitation requires the attacker to have the ability to create or modify menu link titles via menu administration or content menu settings. The vulnerability affects versions prior to 1.25.0 and versions from 2.0.0 up to but not including 2.0.1. A patch is available to remediate this issue.

If exploited, this vulnerability could allow injection of malicious content into HTML class attributes, which might lead to unintended behavior or styling issues. However, exploitation is limited by the prerequisite that the attacker must have permissions to create or modify menu link titles, reducing the risk to privileged users or trusted content editors.

A patch is available and should be applied to affected versions to remediate the vulnerability. Until patched, restrict permissions to create or modify menu link titles to trusted users only to mitigate exploitation risk.