CVE-2026-84935: HT Menu < 1.2.7 - Subscriber+ Stored XSS via Menu Settings
The HT Menu WordPress plugin before 1.2.7 does not perform any capability or object-ownership check when saving navigation menu-item settings, and does not escape those stored settings when the menu is rendered, allowing users with minimal permissions such as Subscribers to store JavaScript that executes in the browser of any visitor, administrators included, who views the affected menu.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue, and who is exposed to the payload?
Users with minimal permissions, including Subscribers, can save malicious JavaScript in navigation menu-item settings. The JavaScript executes in the browser of any visitor who views the affected menu, including administrators.
What conditions are required for exploitation?
An attacker needs an account with minimal WordPress permissions, such as a Subscriber, and must be able to save navigation menu-item settings. Exploitation occurs when a user visits a page where the affected menu is rendered.
Are affected menu settings safe when displayed?
No. Versions before 1.2.7 do not escape the stored menu-item settings when rendering the menu, allowing stored JavaScript to execute in visitors' browsers.