CVE-2026-14855: RT Mega Menu <= 1.5.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via rtmega_update_menu_options AJAX Action
The RT Mega Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'css[left]' parameter in all versions up to, and including, 1.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated WordPress account with at least Subscriber-level access. No user interaction is required for the attacker to submit the malicious input.
When does the injected script execute?
The injected script is stored and executes when a user accesses a page containing the injected content. This can affect other users who view that page.
Which installations are affected?
All RT Mega Menu versions up to and including 1.5.1 are affected. The vulnerable input is the css[left] parameter handled by the rtmega_update_menu_options AJAX action.