CVE-2026-15650 is a stored cross-site scripting vulnerability in the RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg WordPress plugin affecting all versions up to and including 1.5.2. The flaw exists due to improper neutralization of input in the 'pointer_menu_item' block attribute, which allows authenticated attackers with contributor or higher privileges to inject arbitrary JavaScript. The injected payload bypasses the wp_kses_post filtering because it contains no HTML tags and is preserved inside block comment JSON attributes, reaching the rendering walker unescaped and executing in users' browsers.

Successful exploitation allows an attacker with contributor-level access or higher to inject persistent malicious scripts into pages. These scripts execute in the context of users viewing the affected pages, potentially leading to session hijacking, privilege escalation, or other client-side attacks. The vulnerability impacts confidentiality and integrity but does not affect availability. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and partial impact on confidentiality and integrity.

No official patch or fix is currently documented. Users should restrict contributor-level access until a fix is available. Monitor the vendor's advisories for updates. As the vulnerability relies on authenticated access, limiting user privileges and reviewing user roles can reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.