Threats tagged 'ghsa-9jvp-fc5f-j7qr'

CVE-2026-15385 is a cross-site scripting (XSS) vulnerability in the RT Mega Menu WordPress plugin before version 1.5.2. It arises because the plugin does not properly check user capabilities on an AJAX action that saves menu configurations, relying only on a nonce accessible to any logged-in user. This allows subscriber-level users to inject malicious JavaScript into the public navigation menu, which executes when visitors hover over the menu, potentially leading to session or site takeover.