Vulnerability Directory | CVE-2026-16132

Overview

Drupal is an open-source content management system known for its flexibility, robust features, and strong community support. Organizations of all sizes use it to build and manage dynamic websites and web applications.

Icon API is a Drupal module that provides a unified framework for managing and rendering icon sets across a site, allowing site builders to attach icons to menu items, fields, filters, and blocks through a consistent interface with configurable display options.

A cross-site scripting (XSS) vulnerability allows attackers to inject malicious scripts into webpages. It often occurs when a site fails to properly validate or sanitize user input, enabling the execution of unauthorized code within a victim's browser. It is included in the OWASP Top Ten list of vulnerabilities, specifically in the third category of Injection. A web site compromised in this way may experience:

Session hijacking
Data theft
Malware distribution
Defacement or phishing and
Privilege escalation.

Regarding this exploit, on affected sites a user with the "administer menu icons" permission could inject a malicious script into a menu item's Title Wrapper Class field. Any visitor who hovers over that menu item would execute the attacker's JavaScript, potentially exposing session cookies, enabling account hijacking, or facilitating further attacks against site users.

‍

Details

Module Info

Product: Drupal 7
Affected packages: Icon API
Affected versions: <=7.1.0
Repository: https://git.drupalcode.org/project/icon
Published packages: https://www.drupal.org/project/icon
Package manager: composer
Fixed in: Icon API NES 7.1.1

‍

Vulnerability Info

This medium-severity vulnerability is found in versions of the Drupal Icon API module for Drupal 7 sites from 7.x-1.0 through 7.1.0 (inclusive).

The Icon API: Menu submodule allows site builders to attach icons to menu items with optional display settings, including a Title Wrapper feature that wraps the menu item's title text in an HTML element. This wrapper accepts a configurable CSS class via the Title Wrapper Class field. However, due to a flaw in how the module rendered this value, the class attribute was output directly into the HTML without sanitization or escaping.

In practical terms, this means a user with the "administer menu icons" permission could enter a malicious string into the Title Wrapper Class field such as title" onmouseover="alert(document.cookie) — and have it rendered verbatim as an HTML attribute on every page that displays the affected menu item. Any visitor who interacts with the menu link would unknowingly execute the injected JavaScript in their browser, potentially exposing session cookies or enabling further attacks such as account hijacking.

‍

Steps To Reproduce

On the latest stable version of Drupal 7, install and enable a susceptible version of the Icon module (such as 7.x-1.0) and the Icon API: Menu submodule.
Create or log in as a user with the "administer menu icons" permission.
Navigate to Admin → Structure → Menus, choose any menu, and add or edit an existing menu item (an actual link).
In the menu item edit form, locate the Icon fieldset. Enable an icon and check the Title Wrapper option.
In the Title Wrapper Class field, enter the following payload:

title" onmouseover="alert(document.cookie)

Save the menu item.
Visit any page that renders that menu link.
Hover over the menu item and observe that the JavaScript executes — alert(document.cookie) fires, confirming unsanitized output of the Title Wrapper Class attribute.
Use the Icon API NES module instead, re-run the steps above with the same payload, and observe that the output is properly sanitized and the JavaScript does not execute.

‍

Addressing the Issue

Users of this module should apply one of the following mitigations:

If the risk is unacceptable, disable the Icon API: Menu submodule until the fix can be deployed.
Restrict the "administer menu icons" permission to highly trusted users only.
Audit existing menu items for suspicious values in the Title Wrapper Class field and remove any unexpected content.
Sign up for post-EOL security support—HeroDevs customers get immediate access to a patched version of this module.

‍