CVE-2026-15650: RT Mega Menu WordPress Plugin XSS Vulnerability

CVE-2026-15650 Overview

CVE-2026-15650 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin for WordPress. The flaw affects all versions up to and including 1.5.2. The plugin fails to properly sanitize input and escape output for the pointer_menu_item block attribute. Authenticated users with contributor-level access or higher can inject arbitrary JavaScript into pages. The payload executes in the browser of any visitor who loads an affected page.

Critical Impact
Authenticated contributors can persist JavaScript payloads that execute in the context of every visitor, enabling session theft, account takeover, and administrative privilege escalation through targeted attacks against site administrators.

Affected Products

RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg (WordPress plugin)
All versions up to and including 1.5.2
WordPress sites permitting contributor-level or higher registration

Discovery Timeline

2026-09-18 - CVE-2026-15650 published to NVD
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-15650

Vulnerability Analysis

The vulnerability resides in how the RT Mega Menu plugin processes the pointer_menu_item block attribute stored inside Gutenberg block comment JSON. When a post is saved, WordPress applies wp_kses_post filtering to post content. That filter targets HTML tags in the visible body. The attacker payload contains no HTML tags at save time, so wp_kses_post does not strip it. The value survives intact inside the block comment's JSON attributes.

At render time, the plugin passes the attribute value to the navigation walker in rtmega-nav-walker.php and to the block render logic in render.php. The walker outputs the attribute without escaping it for HTML context. The injected content becomes active markup in the rendered page and executes in the visitor's browser.

Root Cause

The root cause is missing output escaping on a block attribute that reaches the DOM through a server-side walker. The plugin relies on WordPress content filtering that operates on post body HTML, not on JSON-encoded block attributes. Attribute values reach esc_attr-free code paths in the render pipeline. See the RT Mega Menu render code and the nav walker code for the vulnerable code paths.

Attack Vector

An authenticated attacker with contributor privileges creates or edits a post containing an RT Mega Menu block. The attacker sets the pointer_menu_item attribute to a payload that avoids raw HTML tags at save time but decodes into executable script at render. When an administrator or visitor loads the affected page, the walker emits the attribute into the response, and the browser executes the injected script under the site's origin.

The vulnerability requires no user interaction beyond page visits. Technical details are documented in the Wordfence vulnerability report.

Detection Methods for CVE-2026-15650

Indicators of Compromise

Unexpected <script> tags or event handler attributes rendered inside RT Mega Menu navigation markup on published pages.
Post revisions authored by contributor-role users that include pointer_menu_item values containing encoded quotes, angle brackets, or JavaScript function references.
Outbound requests from visitor sessions to attacker-controlled domains shortly after visiting pages containing RT Mega Menu blocks.
New administrator accounts or privilege changes following visits by administrators to contributor-authored content.

Detection Strategies

Audit wp_posts and wp_postmeta for RT Mega Menu block comments and inspect the JSON attribute set for suspicious pointer_menu_item values.
Enable a Content Security Policy report-only header to surface inline script execution on WordPress pages that render navigation menus.
Correlate contributor-role edits with subsequent administrator page views in web server access logs.

Monitoring Recommendations

Monitor WordPress user role assignments and flag new contributor accounts created shortly before block edits.
Track plugin file integrity for rtmega-nav-walker.php and render.php to identify unauthorized modification.
Alert on browser console errors and CSP violations originating from pages that embed RT Mega Menu blocks.

How to Mitigate CVE-2026-15650

Immediate Actions Required

Update the RT Mega Menu plugin to a version later than 1.5.2 once the vendor publishes a patched release.
Review all posts and pages containing RT Mega Menu blocks and remove any pointer_menu_item values that include script content or encoded payloads.
Restrict contributor-level and above accounts to trusted users and audit recent registrations.

Patch Information

At the time of publication, the NVD entry does not list a fixed version. Site operators should track the plugin's WordPress.org page and the Wordfence advisory for the patched release. Apply the update as soon as the vendor issues it.

Workarounds

Deactivate the RT Mega Menu plugin until a patched version is available if navigation functionality is not business-critical.
Disable open user registration or lower default new-user roles below contributor to reduce the attacker pool.
Deploy a web application firewall rule that blocks requests containing script payloads targeting Gutenberg block attributes.
Enforce a strict Content Security Policy that disallows inline scripts on pages rendering navigation blocks.

bash

# Configuration example: disable open registration and enforce lowest default role
wp option update users_can_register 0
wp option update default_role subscriber

# Temporarily deactivate the vulnerable plugin
wp plugin deactivate rt-mega-menu