Executive brief
The HT Menu WordPress plugin fails to validate user permissions when saving navigation menu settings, allowing low-privilege users (Subscribers) to inject malicious JavaScript code into menu configurations. When the menu is rendered on the website's front-end, this injected code executes in the browsers of all visitors, including administrators, potentially leading to session hijacking, credential theft, or malware distribution.
Technical details
The HT Menu plugin (before 1.2.7) contains a stored cross-site scripting (XSS) vulnerability in its navigation menu settings handler. The vulnerability stems from missing capability checks on the AJAX endpoints that save menu and menu-item settings, combined with insufficient output escaping when rendering stored menu configuration data. An attacker with Subscriber-level WordPress access can submit arbitrary HTML/JavaScript payloads via the AJAX action handlers (HT_Mega_Menu_Panels_ajax_requests with sub_action save_menu_settings or save_menu_options). The stored payload executes in the browsers of any site visitor—including administrators—when the affected menu is viewed. This requires the plugin and Elementor to be active, and a navigation menu assigned with at least one parent-child menu structure.
Affected products
- HT Menu HT Menu before 1.2.7
Timeline
- 2026-09-03: disclosed
- 2026-09-05: patched: Version 1.2.7 available