Stored Cross-Site Scripting Vulnerability in RT Mega Menu Plugin for WordPress

CVE-2026-15650

What is CVE-2026-15650?

The RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability. This issue arises due to inadequate input sanitization and output escaping within the 'pointer_menu_item' block attribute, affecting all versions up to and including 1.5.2. Authenticated users with contributor-level access can exploit this vulnerability to inject arbitrary web scripts into WordPress pages. The malicious payload bypasses the wp_kses_post filtering during the content's save operation since it contains no HTML tags, allowing it to remain intact within the JSON attributes of block comments. Consequently, the injected scripts execute whenever a user accesses the compromised page, posing a significant risk to site security and user data integrity.

References