CVE-2026-15385
Received Received - Intake

Stored XSS in RT Mega Menu WordPress Plugin

Publication date: 2026-08-02

Last updated on: 2026-08-02

Assigner: WPScan

Description
The RT Mega Menu WordPress plugin before 1.5.2 does not perform a capability check on the AJAX action that saves mega-menu configuration and per-menu-item settings; its only gate is a nonce that any logged-in user can read from a standard admin page. A subscriber-level user can therefore enable the mega menu on a site menu and store a menu-item style value that is rendered, without output escaping, into a style attribute on the public navigation. By breaking out of that attribute the user persists a JavaScript event handler that executes for every visitor who hovers the navigation, including administrators, leading to session/site takeover.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-02
Last Modified
2026-08-02
Generated
2026-08-02
AI Q&A
2026-08-02
EPSS Evaluated
N/A
NVD
CVE-2026-15385
EUVD
EUVD-2026-51936

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
rt_mega_menu rt_mega_menu to 1.5.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the RT Mega Menu WordPress plugin before version 1.5.2. It lacks a proper capability check on an AJAX action used to save menu configurations. Instead, it relies on a nonce that any logged-in user can access. A subscriber-level user can exploit this to enable the mega menu and inject malicious JavaScript into menu item styles. This JavaScript executes when visitors hover over the navigation, including administrators, leading to potential session or site takeover.

Detection Guidance

Check for unauthorized changes in WordPress menu configurations or style attributes. Inspect admin pages for the RT Mega Menu plugin and verify user roles with access to menu settings. Look for suspicious JavaScript event handlers in navigation elements.

Impact Analysis

If you are a WordPress site administrator using the RT Mega Menu plugin before version 1.5.2, a low-privilege user like a subscriber could take over your site. They could inject malicious scripts that run for every visitor, including admins, compromising user sessions or the entire site. This could lead to data theft, defacement, or further attacks.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by enabling unauthorized JavaScript execution on a website. If exploited, it could lead to session hijacking or site takeover, compromising user data confidentiality and integrity. This may result in non-compliance with data protection requirements under these regulations.

Mitigation Strategies

Update the RT Mega Menu plugin to version 1.5.2 or later. Review and remove any unauthorized menu configurations or style attributes. Restrict subscriber-level user permissions to prevent unauthorized access to menu settings.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15385. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart