CVE-2026-91832
Received Received - Intake

WP Mobile Menu Plugin Settings Import Stored XSS

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: WPScan

Description
The WP Mobile Menu WordPress plugin before 2.9 does not correctly verify the nonce on its settings import, so an attacker can import arbitrary WP Mobile Menu WordPress plugin before 2.9 settings through a cross-site request in an administrator's session, and the imported values are then output unescaped to every visitor, resulting in Stored Cross-Site Scripting.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-30
Last Modified
2026-09-30
Generated
2026-09-30
AI Q&A
2026-09-30
EPSS Evaluated
N/A
NVD
CVE-2026-91832
EUVD
EUVD-2026-89620

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
wp_mobile_menu wp_mobile_menu to 2.9 (exc)
wp_mobile_menu wp_mobile_menu 2.7.4
wp_mobile_menu wp_mobile_menu 2.8.8

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a stored Cross-Site Scripting (XSS) flaw in the WP Mobile Menu WordPress plugin versions before 2.9. It occurs because the plugin fails to properly verify a nonce during settings import, allowing attackers to inject malicious JavaScript via a cross-site request forgery (CSRF) attack. The injected scripts are then stored and executed for all visitors.

Detection Guidance

Check the installed version of the WP Mobile Menu plugin. If it is between 2.7.4 and 2.8.8, the system is vulnerable. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files for version details.

Impact Analysis

An attacker could exploit this to execute arbitrary JavaScript in the browsers of all visitors to your site. This could lead to theft of cookies, session hijacking, defacement of your website, or redirection to malicious sites. Administrators are particularly at risk if tricked into importing malicious settings.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection requirements. For HIPAA, it may compromise protected health information if exploited on healthcare-related sites. Both standards require protection against such attacks to maintain compliance.

Mitigation Strategies

Update the WP Mobile Menu plugin to version 2.9 or later immediately. If updating is not possible, disable the plugin temporarily until an update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91832. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart