CVE-2026-15385: RT Mega Menu < 1.5.2 - Subscriber+ Stored XSS via Menu Item CSS
The RT Mega Menu WordPress plugin before 1.5.2 does not perform a capability check on the AJAX action that saves mega-menu configuration and per-menu-item settings; its only gate is a nonce that any logged-in user can read from a standard admin page. A subscriber-level user can therefore enable the mega menu on a site menu and store a menu-item style value that is rendered, without output escaping, into a style attribute on the public navigation. By breaking out of that attribute the user persists a JavaScript event handler that executes for every visitor who hovers the navigation, including administrators, leading to session/site takeover.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
RT Mega Menuto a version that resolves this vulnerability.Fixed in 1.5.2 - Configuration
Modify the plugin so the AJAX endpoint that saves mega-menu configuration and per-menu-item CSS performs a capability check (beyond the nonce) and rejects requests from users who are not allowed to update mega-menu settings.
RT Mega Menu (WordPress plugin) AJAX action capability check for mega-menu configuration and per-menu-item settings = Require administrator or appropriate capability; do not rely only on nonce
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15385?
CVE-2026-15385 has a risk score of 71, indicating a significant security vulnerability.
How do I fix CVE-2026-15385?
To fix CVE-2026-15385, update the RT Mega Menu plugin to version 1.5.2 or later.
What type of vulnerability is CVE-2026-15385?
CVE-2026-15385 is a stored Cross-Site Scripting (XSS) vulnerability affecting the RT Mega Menu plugin.
Who is affected by CVE-2026-15385?
Users of the RT Mega Menu plugin prior to version 1.5.2 are affected by CVE-2026-15385.
What actions can a subscriber-level user take in relation to CVE-2026-15385?
A subscriber-level user can exploit CVE-2026-15385 to inject malicious scripts through the menu item CSS.