CVE-2026-84935: CWE-79 Cross-Site Scripting (XSS) in HT Menu

CVE-2026-84935 is a cross-site scripting (XSS) vulnerability in the HT Menu WordPress plugin versions prior to 1.2.7. The flaw arises from the lack of capability and ownership checks when saving navigation menu-item settings, combined with the absence of escaping stored settings during menu rendering. This allows low-privileged users to inject malicious JavaScript code that executes in the context of any user viewing the menu, including administrators. The vulnerability has a CVSS 3.1 score of 8.0, reflecting its high severity and potential impact on confidentiality, integrity, and availability.

An attacker with minimal permissions (e.g., Subscriber role) can inject JavaScript code into navigation menu items. This malicious script executes in the browsers of any users who view the affected menu, including administrators. This can lead to theft of sensitive information, session hijacking, or other malicious actions performed with the privileges of the victim user. The vulnerability affects confidentiality, integrity, and availability of the affected WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user permissions to trusted users only and avoid granting menu editing capabilities to low-privileged users. Monitor for updates from the plugin vendor and apply any official patches promptly once released.