CVE-2026-15385 is a cross-site scripting vulnerability in the RT Mega Menu WordPress plugin prior to version 1.5.2. The vulnerability arises because the plugin does not verify user capabilities on an AJAX action responsible for saving mega-menu configurations and per-menu-item settings. Instead, it relies solely on a nonce that any logged-in user can obtain from a standard admin page. This flaw allows a subscriber-level user to inject JavaScript by manipulating a menu-item style attribute that is rendered without proper output escaping on the public navigation menu. The injected script executes when visitors hover over the navigation, including administrators, which can lead to session hijacking or site takeover.

An attacker with subscriber-level access can exploit this vulnerability to inject persistent JavaScript code into the site's navigation menu. This script executes in the context of every visitor, including site administrators, potentially enabling session hijacking or full site compromise. The vulnerability undermines site integrity and user trust by allowing unauthorized script execution on the public-facing site.

No official patch or remediation is currently confirmed for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level user capabilities if possible and monitor for suspicious activity. Avoid granting unnecessary permissions to low-privilege users. Follow vendor updates closely for an official fix.