Executive brief
RT Mega Menu is a WordPress plugin that provides menu building functionality for the Elementor and Gutenberg page builders. The plugin fails to properly sanitize and escape user input in menu item attributes, allowing contributors and above to inject malicious scripts into pages. When other users view these pages, the injected scripts execute in their browsers, potentially enabling account hijacking, data theft, or malware distribution.
Technical details
The vulnerability is a Stored Cross-Site Scripting (XSS) flaw in the 'pointer_menu_item' block attribute of the RT Mega Menu plugin. The root cause is insufficient input sanitization and output escaping; the plugin stores untrusted input in block comment JSON attributes without validation, and fails to escape this data during render time. The vulnerability affects authenticated users with contributor-level access or higher. The attack succeeds because the payload bypasses wp_kses_post filtering (which only strips HTML tags) by containing no HTML tags itself—it survives in the JSON attributes and reaches the walker unescaped at render time. An attacker can inject arbitrary JavaScript that executes whenever any user views the affected page. Patches are available in versions after 1.5.2.
Affected products
- RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg up to and including 1.5.2
Timeline
- 2026-09-18: disclosed
- 2026-09-18: advisory: CVE-2026-15650 published