The ZeroPoint theme provides configurable layouts and visual styling for Drupal websites, including support for Font Awesome icons in navigation… (CVE-2026-114528)

The ZeroPoint Drupal theme allows configurable layouts and visual styling, including Font Awesome icon support in navigation menus. It fails to sufficiently sanitize menu link titles before inserting them into HTML class attributes, which could lead to security issues if an attacker can create or modify these titles. Exploitation requires the attacker to have the ability to create or modify menu link titles via menu administration or content menu settings. The vulnerability affects versions prior to 1.30.0 and versions from 2.0.0 up to but not including 2.0.1. A patch is available to address this issue.

If exploited, this vulnerability could allow an attacker with menu link title modification privileges to inject malicious content or manipulate HTML class attributes, potentially leading to cross-site scripting or other client-side attacks. However, exploitation requires elevated permissions to modify menu link titles, limiting the scope of impact.

A patch is available for this vulnerability and should be applied to affected versions of the ZeroPoint theme. Since exploitation requires the ability to create or modify menu link titles, restricting these permissions can also mitigate risk. Review and update permissions for menu administration and content menu settings accordingly.