EUVD-2026-51936
GHSA-9jvp-fc5f-j7qr
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
PR:L reflects the subscriber-level account requirement; UI:R because victim hover interaction triggers the stored payload; S:C because XSS crosses the plugin trust boundary into other users' browser sessions.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The RT Mega Menu WordPress plugin before 1.5.2 does not perform a capability check on the AJAX action that saves mega-menu configuration and per-menu-item settings; its only gate is a nonce that any logged-in user can read from a standard admin page. A subscriber-level user can therefore enable the mega menu on a site menu and store a menu-item style value that is rendered, without output escaping, into a style attribute on the public navigation. By breaking out of that attribute the user persists a JavaScript event handler that executes for every visitor who hovers the navigation, including administrators, leading to session/site takeover.
AnalysisAI
Stored XSS in the RT Mega Menu WordPress plugin (versions before 1.5.2) allows any subscriber-level authenticated user to inject persistent JavaScript into the site's public navigation, executing against every visitor who hovers over menu items - including administrators - enabling session theft and full site takeover. The AJAX endpoint that saves mega-menu configuration performs no capability check, relying solely on a nonce that any logged-in user can read from a standard admin page, making the access barrier trivially low. A public exploit is documented by WPScan, and the vendor has released version 1.5.2 as the confirmed fix; no public exploit identified at time of analysis corresponds to active widespread exploitation (no CISA KEV listing), though the public exploit code exists and the low subscriber-level barrier makes this dangerous on sites with open registration.
Technical ContextAI
The RT Mega Menu plugin (CPE: cpe:2.3:a:unknown:rt_mega_menu:*:*:*:*:*:*:*:*) extends WordPress navigation with configurable mega-menu layouts and per-item styling via AJAX-based settings endpoints. The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting), specifically the persistent/stored variant. The root cause is a two-layer failure: first, the AJAX action handler omits WordPress capability checks (e.g., current_user_can()), using only nonce verification - but the nonce is embedded in standard admin-side pages accessible to subscribers, collapsing the intended access gate; second, the menu-item style value accepted by this endpoint is echoed verbatim into an HTML style attribute in the public navigation without sanitization or output escaping. An attacker breaks out of the style attribute context using standard injection techniques (closing the attribute, injecting an event handler such as onmouseover), producing JavaScript that executes in every visitor's browser on hover. Because the payload persists in the WordPress database and is rendered site-wide, a single low-privilege write results in a persistent client-side code injection affecting all users of the public navigation.
RemediationAI
Update the RT Mega Menu WordPress plugin to version 1.5.2 or later immediately, as this is the confirmed vendor-released fix per the WPScan advisory at https://wpscan.com/vulnerability/b13b19c6-b6e1-45eb-95f3-ac334bda8b84/ and tracked under NVD at https://nvd.nist.gov/vuln/detail/CVE-2026-15385. If immediate patching is not feasible, deactivate the RT Mega Menu plugin entirely to remove the vulnerable AJAX action from the attack surface - this reverts navigation to standard WordPress menus and eliminates the injection point without data loss. As a compensating control to reduce the subscriber access prerequisite, disable open user registration via Settings > General > uncheck 'Anyone can register'; note this does not remediate the vulnerability for sites where subscriber accounts already exist or are provisioned by other means. A WAF rule blocking AJAX requests to admin-ajax.php with the specific plugin action parameter may provide partial protection but risks disrupting legitimate plugin functionality and should be treated as a temporary measure only.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today