CVE-2026-14855 is a stored cross-site scripting vulnerability in the RT Mega Menu plugin for WordPress (versions <=1.5.1). The flaw exists in the handling of the 'css[left]' parameter, which lacks proper input sanitization and output escaping. Authenticated attackers with Subscriber-level privileges or higher can exploit this to inject arbitrary web scripts that execute in the context of users visiting the compromised pages.

Successful exploitation allows attackers to execute arbitrary scripts in the context of users viewing the affected pages, potentially leading to session hijacking, privilege escalation, or other malicious actions limited to the scope of the injected script. The vulnerability requires authenticated access at Subscriber level or above and does not impact availability.

No official patch or fix is currently documented. Users should monitor the vendor's advisory channels for updates. Until a fix is available, restrict Subscriber-level user capabilities where possible and consider disabling or replacing the plugin to mitigate risk.