CVE-2026-91832 is a stored cross-site scripting vulnerability in the WP Mobile Menu WordPress plugin before version 2.9. The vulnerability occurs due to improper nonce verification on the settings import feature, enabling attackers to import malicious settings during an administrator's session via a cross-site request. These malicious settings are subsequently rendered unescaped to all visitors, resulting in stored XSS.

An attacker can execute arbitrary JavaScript in the context of the website for all visitors by exploiting this vulnerability. This can lead to session hijacking, defacement, or other malicious actions performed on behalf of users visiting the affected site. The attack requires an administrator to be logged in and tricked into making a cross-site request.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid importing settings from untrusted sources and consider restricting administrative access to trusted networks or users only.