CVE-2026-91832: WP Mobile Menu 2.7.4 - 2.8.8 - Stored XSS via CSRF
The WP Mobile Menu WordPress plugin before 2.9 does not correctly verify the nonce on its settings import, so an attacker can import arbitrary WP Mobile Menu WordPress plugin before 2.9 settings through a cross-site request in an administrator's session, and the imported values are then output unescaped to every visitor, resulting in Stored Cross-Site Scripting.
Affected Software
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
The attacker must cause a WP Mobile Menu administrator with an active session to submit a cross-site request that imports attacker-controlled plugin settings. The flawed nonce verification on the settings import enables this request.
Who is exposed after a successful exploit?
Every visitor to the affected site may be exposed, because the imported settings values are output without escaping. This turns the imported payload into stored cross-site scripting.
Which versions are affected?
WP Mobile Menu versions before 2.9 are affected. The reported vulnerable range includes 2.7.4 through 2.8.8.