RT Mega Menu CVE-2026-15650

Requires an authenticated WordPress account with contributor-level capabilities or higher on a site running RT Mega Menu ≤1.5.2 with the Gutenberg RT Mega Menu block available. The attacker injects a tag-less script payload into the block's 'pointer_menu_item' attribute; because the payload contains no HTML tags it survives wp_kses_post filtering applied to post content on save and is stored intact in the block comment JSON. Execution is triggered passively when any user (admin, editor, or visitor) views the affected page - no attacker interaction at trigger time (UI:N). Limiting factors: exploitation is impossible without a contributor+ account, so sites that do not provision untrusted authoring accounts face substantially reduced real-world risk; impact is confined to browser-side script execution (C:L/I:L, A:N).

This is a moderate-severity stored XSS (vendor CVSS 6.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) whose real-world priority is tempered by its authentication gate. The PR:L metric maps directly to the description's 'contributor-level access and above' requirement, so this is not an unauthenticated internet-wide bug - an attacker must already hold a low-privileged authoring account. No EPSS score, KEV listing, SSVC decision data, or public POC was supplied in the input, so exploitation-probability signals are absent rather than negative; the only exploitation intelligence is the Wordfence threat-intel disclosure, which is a research advisory, not an in-the-wild report. The technical detail is credible and specific: the payload is tag-less JSON inside a Gutenberg block comment that slips past wp_kses_post (which only filters HTML tags in post content) and reaches the nav walker unescaped at render (render.php L306/L32, rtmega-nav-walker.php L182). Net assessment: a genuine but not urgent issue - real because the bypass mechanism is documented against specific source lines, but gated behind contributor auth and limited to C:L/I:L impact (session/DOM-level script execution, not server compromise). Treat as a standard 'patch in normal cycle' XSS unless the site grants contributor accounts to untrusted users, which raises priority.

An attacker with a contributor account on a WordPress site running RT Mega Menu ≤1.5.2 inserts a crafted RT Mega Menu block whose 'pointer_menu_item' attribute holds a tag-less JavaScript payload that survives wp_kses_post sanitization inside the block comment JSON. When an administrator, editor, or visitor later views the page, the walker renders the attribute unescaped and the script executes in their browser (S:C). No public exploit code is identified in the provided data, though Wordfence has documented the vulnerable code paths.