This vulnerability (CVE-2026-59559) is classified as CWE-79, indicating improper neutralization of input leading to cross-site scripting. It affects RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg versions up to 1.5.1. The flaw allows subscriber-level users to inject malicious scripts during web page generation, potentially impacting confidentiality, integrity, and availability to a limited extent. The CVSS 3.1 base score is 6.5 (medium), with network attack vector, low attack complexity, requiring low privileges and user interaction, and scope changed. No official fix or patch has been documented as of the published date.

Successful exploitation could allow an attacker with subscriber-level privileges to execute arbitrary scripts in the context of the affected application, potentially leading to partial confidentiality, integrity, and availability impacts. However, the attack requires user interaction and low privileges, limiting the scope of impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting subscriber input or applying additional input validation and sanitization controls where possible to mitigate risk.