CVE-2026-15650

The RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'pointer_menu_item' Block Attribute in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload bypasses wp_kses_post filtering applied to post content on save because it contains no HTML tags and survives intact inside the block comment's JSON attributes, reaching the walker unescaped at render time.

• CWE-79

• https://plugins.trac.wordpress.org/browser/rt-mega-menu/tags/1.5.2/public/blocks/rt-mega-menu/build/render.php#L306
• https://plugins.trac.wordpress.org/browser/rt-mega-menu/tags/1.5.2/public/blocks/rt-mega-menu/build/render.php#L32
• https://plugins.trac.wordpress.org/browser/rt-mega-menu/tags/1.5.2/public/includes/rtmega-nav-walker.php#L182
• https://www.wordfence.com/threat-intel/vulnerabilities/id/024d5962-0e8f-43cb-90dc-c282a5e436f2?source=cve

Published

Sep 18, 2026

Last Modified

Sep 18, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-15645The Powerkit – Supercharge your WordPress Site plugin for Wo…6.4
• CVE-2026-15646The Brands for WooCommerce plugin for WordPress is vulnerabl…6.4
• CVE-2026-15647The Brands for WooCommerce plugin for WordPress is vulnerabl…4.4
• CVE-2026-15648The Brands for WooCommerce plugin for WordPress is vulnerabl…6.4
• CVE-2026-15649The Powerkit – Supercharge your WordPress Site plugin for Wo…6.4
• CVE-2026-1565The User Frontend: AI Powered Frontend Posting, User Directo…8.8
• CVE-2026-15651The WP TripAdvisor Review Slider plugin for WordPress is vul…4.9
• CVE-2026-15652The Easy Accordion – AI-Powered FAQ & Accordion Blocks, Prod…6.4
• CVE-2026-15653The Visualizer – Tables & Charts Manager with Built-in AI Ge…6.4
• CVE-2026-15656IBM Maximo Application Suite 9.2, 9.1, and 9.0 does not set …4.3
• CVE-2026-15657A vulnerability in the foreUP customer REST API allows any a…6.5
• CVE-2026-15658A vulnerability in the foreUP customer REST API allows any a…8.1