CVE-2026-15385: RT Mega Menu WordPress XSS Vulnerability

CVE-2026-15385 Overview

CVE-2026-15385 is a stored Cross-Site Scripting (XSS) vulnerability in the RT Mega Menu WordPress plugin before version 1.5.2. The plugin exposes an AJAX action that saves mega-menu configuration and per-menu-item settings without a capability check. The only gate is a nonce that any authenticated user can read from a standard admin page. A subscriber-level attacker can enable the mega menu and persist a menu-item style value that renders unescaped into a style attribute on public navigation.

Critical Impact
An authenticated subscriber can persist JavaScript that executes for every site visitor, including administrators, enabling session hijacking and site takeover [CWE-79].

Affected Products

RT Mega Menu WordPress plugin versions prior to 1.5.2

Discovery Timeline

2026-08-02 - CVE-2026-15385 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-15385

Vulnerability Analysis

The RT Mega Menu plugin registers an AJAX handler that persists mega-menu configuration and per-menu-item settings. The handler verifies a nonce but omits a current_user_can() capability check. Because the nonce is exposed on a standard admin page reachable by any authenticated role, subscribers can obtain it and invoke the handler.

The stored menu-item style value is later rendered into a style attribute on the public navigation without output escaping. An attacker breaks out of the attribute context to inject a JavaScript event handler such as onmouseover. The payload executes in the browser of every visitor who hovers the navigation, including logged-in administrators.

Root Cause

The root cause is a combination of missing authorization and missing output encoding. Nonces provide CSRF protection, not authorization, and cannot substitute for a role or capability check on privileged actions. The rendering path additionally fails to escape untrusted input written into an HTML attribute, allowing attribute-context escape.

Attack Vector

An attacker registers or uses an existing subscriber account. The attacker loads an admin page that exposes the AJAX nonce, then sends a crafted POST request to the vulnerable AJAX action. The payload enables the mega menu and stores a style value containing an attribute-escape sequence and a JavaScript event handler. When any visitor, including an administrator, hovers the affected menu, the payload executes and can hijack sessions or perform authenticated administrative actions.

See the WPScan Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-15385

Indicators of Compromise

Unexpected style attributes on navigation menu items containing quote characters followed by event handlers such as onmouseover, onclick, or onfocus.
WordPress postmeta or plugin option rows for RT Mega Menu containing HTML control characters, javascript: URIs, or <script> fragments.
Admin-ajax requests to the RT Mega Menu save action originating from low-privilege user sessions.

Detection Strategies

Audit rendered HTML of public navigation for style attributes containing suspicious characters or JavaScript event handlers.
Review WordPress access logs for POST requests to /wp-admin/admin-ajax.php invoking the RT Mega Menu save action from subscriber-role accounts.
Query the database for menu-item meta values associated with RT Mega Menu that contain quote characters, angle brackets, or on* handler names.

Monitoring Recommendations

Alert on subscriber or low-privilege accounts issuing AJAX requests to plugin configuration endpoints.
Monitor for new subscriber registrations followed by admin-ajax activity within a short interval.
Track changes to WordPress menu structures and mega-menu settings outside change windows.

How to Mitigate CVE-2026-15385

Immediate Actions Required

Update the RT Mega Menu plugin to version 1.5.2 or later on all WordPress instances.
Review existing menu-item metadata for injected style values and remove any unexpected content.
Rotate administrator session cookies and passwords if evidence of exploitation exists.

Patch Information

Upgrade RT Mega Menu to version 1.5.2 or later. The fixed release addresses the missing capability check on the AJAX save action and hardens output handling for menu-item style values. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Disable the RT Mega Menu plugin until the site can be updated to version 1.5.2 or later.
Restrict user registration or set the default new-user role to a value that cannot access wp-admin pages exposing the plugin nonce.
Deploy a Web Application Firewall (WAF) rule to block admin-ajax requests to the RT Mega Menu save action from non-administrator sessions.

bash

# Configuration example: disable open registration and force default role
wp option update users_can_register 0
wp option update default_role subscriber