Ht Menu
Monthly
Stored cross-site scripting in the HT Menu WordPress plugin before 1.2.7 allows any authenticated subscriber-level user to inject arbitrary JavaScript into navigation menu-item settings, which then executes in the browser of every site visitor - including administrators - who views the affected menu. The flaw combines two missing controls: no capability or ownership check on the settings-save endpoint, and no output escaping on render. A public exploit is available via WPScan, and vendor-released patch 1.2.7 is available. No public KEV listing; EPSS is low at 0.15%, consistent with targeted rather than mass exploitation.
Cross-Site Request Forgery (CSRF) vulnerability in HasThemes HT Menu plugin <= 1.2.1 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Stored cross-site scripting in the HT Menu WordPress plugin before 1.2.7 allows any authenticated subscriber-level user to inject arbitrary JavaScript into navigation menu-item settings, which then executes in the browser of every site visitor - including administrators - who views the affected menu. The flaw combines two missing controls: no capability or ownership check on the settings-save endpoint, and no output escaping on render. A public exploit is available via WPScan, and vendor-released patch 1.2.7 is available. No public KEV listing; EPSS is low at 0.15%, consistent with targeted rather than mass exploitation.
Cross-Site Request Forgery (CSRF) vulnerability in HasThemes HT Menu plugin <= 1.2.1 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.