SEPTEMBER 19, 2026
Live Feed
Back to database
Case File

CVE-2026-15385

MEDIUM · CVSS 5.4 EPSS 0.13%

Source: NVD + CISA KEV + EPSS · Published 2026-08-02 · Last synced 2026-09-01

CyberRota Analysis

AI-Generated

The RT Mega Menu WordPress plugin prior to version 1.5.2 is vulnerable due to inadequate capability checks on AJAX actions, allowing any logged-in user, including those with subscriber-level access, to manipulate menu configurations. This vulnerability can lead to the injection of malicious JavaScript into the public navigation, potentially resulting in session hijacking or site takeover for all visitors, including administrators. WordPress site administrators and developers using this plugin should prioritize immediate updates to mitigate this risk.

CVE
CVE-2026-15385
Severity
MEDIUM
CVSS
5.4
EPSS
0.13%
WordPress Java

Original NVD Description

The RT Mega Menu WordPress plugin before 1.5.2 does not perform a capability check on the AJAX action that saves mega-menu configuration and per-menu-item settings; its only gate is a nonce that any logged-in user can read from a standard admin page. A subscriber-level user can therefore enable the mega menu on a site menu and store a menu-item style value that is rendered, without output escaping, into a style attribute on the public navigation. By breaking out of that attribute the user persists a JavaScript event handler that executes for every visitor who hovers the navigation, including administrators, leading to session/site takeover.