Rt Mega Menu Mega Menu Builder For Elementor Gutenberg
Monthly
Stored cross-site scripting in the WordPress plugin RT Mega Menu - Mega Menu Builder for Elementor & Gutenberg (all versions through 1.5.1) allows an attacker with an authenticated Subscriber-level account or higher to inject arbitrary JavaScript through the 'css[left]' mega-menu styling parameter, which is persisted and then executed in the browser of every visitor who loads a page rendering the poisoned menu. The assessed severity is moderate (CVSS 6.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), with the low privilege bar rather than the payload itself being the main limiting factor; no public exploit code and no confirmed active exploitation were identified at time of analysis, so priority should be driven by whether the site allows self-registration or hosts untrusted low-privileged users.
Stored cross-site scripting in the WordPress plugin RT Mega Menu - Mega Menu Builder for Elementor & Gutenberg (all versions up to and including 1.5.2) allows authenticated attackers holding contributor-level or higher privileges to plant a tag-less script payload in a block's 'pointer_menu_item' attribute, which then executes in the browser of any administrator, editor, or visitor who opens the injected page. Because the payload contains no HTML tags it slips past the wp_kses_post filtering applied on save and survives intact inside the block comment's JSON attributes, so the plugin's navigation walker renders it unescaped. Vendor CVSS 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N); no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV); the contributor-level authentication gate limits real-world exposure to sites that grant untrusted users authoring accounts.
Stored cross-site scripting in the WordPress plugin RT Mega Menu - Mega Menu Builder for Elementor & Gutenberg (all versions through 1.5.1) allows an attacker with an authenticated Subscriber-level account or higher to inject arbitrary JavaScript through the 'css[left]' mega-menu styling parameter, which is persisted and then executed in the browser of every visitor who loads a page rendering the poisoned menu. The assessed severity is moderate (CVSS 6.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), with the low privilege bar rather than the payload itself being the main limiting factor; no public exploit code and no confirmed active exploitation were identified at time of analysis, so priority should be driven by whether the site allows self-registration or hosts untrusted low-privileged users.
Stored cross-site scripting in the WordPress plugin RT Mega Menu - Mega Menu Builder for Elementor & Gutenberg (all versions up to and including 1.5.2) allows authenticated attackers holding contributor-level or higher privileges to plant a tag-less script payload in a block's 'pointer_menu_item' attribute, which then executes in the browser of any administrator, editor, or visitor who opens the injected page. Because the payload contains no HTML tags it slips past the wp_kses_post filtering applied on save and survives intact inside the block comment's JSON attributes, so the plugin's navigation walker renders it unescaped. Vendor CVSS 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N); no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV); the contributor-level authentication gate limits real-world exposure to sites that grant untrusted users authoring accounts.