CVE-2026-84935 Overview
CVE-2026-84935 is a stored Cross-Site Scripting (XSS) vulnerability in the HT Menu WordPress plugin versions prior to 1.2.7. The plugin fails to enforce capability or object-ownership checks when saving navigation menu-item settings. It also fails to escape those stored values when the menu is rendered. Authenticated users with minimal permissions, including Subscribers, can inject JavaScript that executes in the browser of any visitor who views the affected menu, including administrators. The flaw is tracked under [CWE-79] and referenced in the WPScan Vulnerability Report.
Critical Impact
A Subscriber-level account can persist arbitrary JavaScript that executes in an administrator's session, enabling account takeover of the WordPress site.
Affected Products
- HT Menu WordPress plugin versions prior to 1.2.7
- WordPress sites permitting Subscriber or higher registrations with HT Menu installed
- Any site rendering navigation menus built with vulnerable HT Menu versions
Discovery Timeline
- 2026-09-05 - CVE-2026-84935 published to NVD
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-84935
Vulnerability Analysis
The HT Menu plugin exposes an endpoint that persists per-menu-item settings without verifying whether the requesting user has permission to modify the target menu. WordPress typically restricts menu editing to users with the edit_theme_options capability, but HT Menu bypasses this check for its extended settings. A Subscriber, who normally cannot touch site configuration, can therefore write attacker-controlled values into menu-item metadata stored in the database.
When the front end or admin dashboard renders the menu, HT Menu emits those stored values directly into the HTML output without applying esc_html, esc_attr, or wp_kses sanitization. Any <script> tag or event handler embedded in the saved payload executes in the browser of every subsequent viewer. Administrators visiting a page that includes the compromised menu run the attacker's script under their own session, exposing nonces, cookies, and administrative REST endpoints.
Root Cause
Two defects combine to produce the vulnerability. First, the save handler omits both a current_user_can() capability check and any ownership validation against the menu being edited. Second, the render path outputs stored settings without contextual escaping, treating attacker-supplied data as trusted HTML.
Attack Vector
Exploitation requires a low-privilege authenticated account and user interaction in the form of a victim rendering the affected menu. The attacker registers or logs in as a Subscriber, issues a crafted request to the vulnerable menu-item save endpoint containing JavaScript payloads, and waits. When an administrator loads any page rendering the menu, the payload executes with administrator privileges, allowing plugin installation, user creation, or content modification.
No verified proof-of-concept code is published. Refer to the WPScan Vulnerability Report for additional technical detail.
Detection Methods for CVE-2026-84935
Indicators of Compromise
- Unexpected <script> tags, on* event handlers, or javascript: URIs stored in wp_postmeta or wp_options rows associated with HT Menu items
- Newly created administrator accounts or modified user roles with no corresponding admin activity in access logs
- POST requests to HT Menu AJAX or REST endpoints originating from Subscriber-level session cookies
- Outbound requests from administrator browsers to attacker-controlled domains shortly after loading pages that render navigation menus
Detection Strategies
- Audit the WordPress database for HT Menu metadata containing HTML control characters such as <, >, or quoted event handlers
- Review web server logs for authenticated requests to HT Menu save endpoints issued by low-privilege user IDs
- Enable WordPress activity logging plugins to record menu-item modifications with actor identity and payload diffs
Monitoring Recommendations
- Alert on any menu-item save request where the acting user lacks the edit_theme_options capability
- Monitor administrator browser sessions for anomalous XHR or fetch activity toward site REST routes such as /wp-json/wp/v2/users
- Track creation of new privileged accounts and correlate against administrator page-view timestamps
How to Mitigate CVE-2026-84935
Immediate Actions Required
- Update the HT Menu plugin to version 1.2.7 or later on every WordPress instance
- Temporarily disable HT Menu if patching cannot be completed immediately
- Audit existing menu-item settings and remove any entries containing script content or unexpected HTML
- Rotate administrator passwords and invalidate active sessions if compromise is suspected
Patch Information
The vendor addressed the issue in HT Menu version 1.2.7 by enforcing capability checks on the save handler and applying output escaping when rendering menu-item settings. Refer to the WPScan Vulnerability Report for the fixed version reference.
Workarounds
- Disable open user registration or restrict the default role to a value below Subscriber where feasible
- Deploy a Web Application Firewall rule that blocks requests to HT Menu save endpoints from non-editor sessions
- Restrict administrator access to the WordPress dashboard through IP allowlisting to reduce the window of exposure
# Update HT Menu via WP-CLI
wp plugin update ht-menu --version=1.2.7
# Verify installed version
wp plugin get ht-menu --field=version
# Temporarily deactivate if patch cannot be applied
wp plugin deactivate ht-menu
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
