CVE-2026-84935
Received Received - Intake

Stored Cross-Site Scripting in HT Menu WordPress Plugin

Publication date: 2026-09-05

Last updated on: 2026-09-05

Assigner: WPScan

Description
The HT Menu WordPress plugin before 1.2.7 does not perform any capability or object-ownership check when saving navigation menu-item settings, and does not escape those stored settings when the menu is rendered, allowing users with minimal permissions such as Subscribers to store JavaScript that executes in the browser of any visitor, administrators included, who views the affected menu.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-05
Last Modified
2026-09-05
Generated
2026-09-05
AI Q&A
2026-09-05
EPSS Evaluated
N/A
NVD
CVE-2026-84935
EUVD
EUVD-2026-71874

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ht_menu ht_menu to 1.2.7 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in the HT Menu WordPress plugin. It allows users with minimal permissions, like Subscribers, to inject malicious JavaScript into menu settings. The injected script runs when any visitor, including administrators, views the affected menu.

Detection Guidance

Check if the HT Menu WordPress plugin version is below 1.2.7. Log in to your WordPress admin panel, go to Plugins, and verify the installed version of HT Menu. If it is outdated, update it immediately.

Impact Analysis

An attacker could steal session cookies, perform actions on behalf of users, or redirect visitors to malicious sites. Administrators viewing the menu could have their accounts compromised, leading to full site takeover.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection requirements. For HIPAA, it may compromise protected health information if exposed through the injected scripts.

Mitigation Strategies

Update the HT Menu plugin to version 1.2.7 or later. If updating is not immediately possible, consider disabling the plugin until the update can be applied to prevent exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84935. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart