RT Mega Menu CVE-2026-14855

Requires an authenticated WordPress account with Subscriber-level access or above (PR:L) on a site running RT Mega Menu - Mega Menu Builder for Elementor & Gutenberg version 1.5.1 or earlier; the practical prerequisite is a site that permits user self-registration or otherwise grants low-privileged accounts, since the malicious 'css[left]' value is submitted through the plugin's admin AJAX request handler. Exploitation is limited by: (1) needing valid credentials rather than being fully unauthenticated, and (2) requiring a victim to subsequently load a page that renders the injected mega-menu output for the stored script to fire - no immediate user interaction by the attacker is needed (UI:N).

This is a moderate-severity stored XSS (vendor CVSS 6.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) whose real-world priority is tempered by its access requirement. The vector confirms network reach and low complexity, but PR:L means an attacker must already hold at least Subscriber-level credentials on the target WordPress site - not an anonymous internet-wide attack. The scope change (S:C) and C:L/I:L reflect script execution in a victim's browser context rather than server compromise. No EPSS score, no CISA KEV listing, and no public proof-of-concept are present in the supplied data, so this is no public exploit identified at time of analysis and there is no evidence of active exploitation. Wordfence (a credible WordPress-focused source) reported it and links directly to the vulnerable source lines, so the technical claim is well-substantiated even though no fixed version is stated (all versions up to and including 1.5.1 are affected). Net assessment: a genuine but not urgent issue - realistic threat is limited to sites that allow untrusted user self-registration, where a low-privileged account can plant persistent script that fires against any visitor, including administrators.

On a WordPress site running RT Mega Menu <=1.5.1 that permits open registration, an attacker registers a Subscriber account, then submits a malicious payload through the 'css[left]' parameter of the plugin's admin AJAX handler. The injected script is stored and later executes in the browser of any user who views a page rendering the affected mega-menu, enabling session/cookie theft or admin-action forgery if an administrator views the page. No public POC is referenced, but Wordfence links the exact vulnerable code paths.