CVE-2026-14855: RT Mega Menu WordPress Plugin XSS Vulnerability

CVE-2026-14855 Overview

The RT Mega Menu plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the css[left] parameter. All versions up to and including 1.5.1 are affected. The flaw stems from insufficient input sanitization and output escaping in menu styling data handled by the plugin. Authenticated attackers with Subscriber-level access or higher can inject arbitrary JavaScript that executes when other users view the affected pages. The vulnerability is tracked under [CWE-79] and reported through the Wordfence Vulnerability Report.

Critical Impact
Authenticated attackers with minimal (Subscriber) privileges can persist malicious JavaScript into WordPress pages, enabling session theft, account takeover, and admin-context actions when victims load affected menus.

Affected Products

RT Mega Menu plugin for WordPress, versions up to and including 1.5.1
WordPress installations with authenticated users at Subscriber level or above
Sites rendering menus generated by the vulnerable plugin

Discovery Timeline

2026-09-18 - CVE-2026-14855 published to the National Vulnerability Database
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-14855

Vulnerability Analysis

The RT Mega Menu plugin accepts styling attributes through an authenticated AJAX request handler. The css[left] parameter, part of a broader CSS positioning array, is stored in menu term metadata and later rendered into HTML output without adequate escaping. Because the write path requires only Subscriber-level authentication, the barrier to exploitation is low on sites that allow user registration. Stored payloads persist in the database and execute in every visitor's browser context when the affected menu is rendered.

Root Cause

The underlying weakness is a failure to sanitize input at storage time and to escape output at render time [CWE-79]. Relevant code paths reside in admin/includes/admin-ajax-request.php, admin/includes/plugin-scripts.php, public/includes/rt-mega-menu-terms.php, and public/includes/rtmega-nav-walker.php. The plugin trusts the submitted CSS array values and inserts them into style attributes or inline scripts without applying WordPress escaping primitives such as esc_attr() or wp_kses().

Attack Vector

An authenticated attacker sends a crafted AJAX request containing a malicious css[left] value. The payload is persisted in menu term metadata. When any user, including administrators, loads a page rendering the affected menu, the browser executes the injected script under the site's origin. Because the scope changes on execution, the payload can act on behalf of higher-privileged users viewing the page. Verified source references are available in the admin AJAX handler and the nav walker code.

No public proof-of-concept exploit code is available. The vulnerability manifests when unescaped CSS positioning values are written to inline style contexts, allowing attribute-breakout payloads to execute JavaScript. Refer to the Wordfence Vulnerability Report for additional analysis.

Detection Methods for CVE-2026-14855

Indicators of Compromise

Menu term metadata entries containing <script>, javascript:, or event handlers such as onerror= and onload= in CSS position fields
Unexpected wp-admin/admin-ajax.php POST requests with css[left] parameters originating from Subscriber accounts
New or modified administrator accounts created shortly after a menu view by a privileged user
Outbound requests from visitor browsers to unfamiliar domains after loading menu-bearing pages

Detection Strategies

Inspect the wp_termmeta table for RT Mega Menu records containing HTML tags or JavaScript syntax in CSS values
Enable WordPress debug logging and monitor AJAX actions handled by admin-ajax-request.php for anomalous payloads
Deploy a web application firewall rule matching script-like content in menu-related AJAX parameters
Correlate authenticated Subscriber activity with subsequent administrator session anomalies

Monitoring Recommendations

Alert on Subscriber-role accounts invoking plugin AJAX actions outside expected workflows
Track HTTP response bodies for unexpected inline scripts within rendered navigation menus
Monitor for new WordPress user registrations followed by immediate menu-editing AJAX calls
Log and review all changes to plugin-controlled term metadata

How to Mitigate CVE-2026-14855

Immediate Actions Required

Disable the RT Mega Menu plugin until a patched version above 1.5.1 is confirmed installed
Audit all WordPress user accounts with Subscriber-level or higher access and remove unrecognized entries
Review menu term metadata for injected scripts and purge malicious content
Rotate administrator credentials and invalidate active sessions if compromise is suspected

Patch Information

At the time of NVD publication on 2026-09-18, all versions of RT Mega Menu up to and including 1.5.1 are affected. Site owners should monitor the plugin's WordPress.org page and the Wordfence Vulnerability Report for a fixed release and apply it as soon as it becomes available.

Workarounds

Restrict new user registration or set the default role to a custom role without menu-editing capability
Deploy WAF rules blocking script tags and event handlers in css[*] parameters to admin-ajax.php
Apply a Content Security Policy that disallows inline script execution on public pages
Remove the plugin entirely if navigation functionality can be provided by a maintained alternative

bash

# Configuration example: temporarily disable the plugin via WP-CLI
wp plugin deactivate rt-mega-menu
wp plugin status rt-mega-menu