CVE-2026-14855Wordfence

Description

The RT Mega Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'css[left]' parameter in all versions up to, and including, 1.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Severity Level

MEDIUM (6.4)

Published Date

18/09/2026

Last Modified

18/09/2026

Exploitation Status

????

EPSS Score

0.20% (percentile 10.3%)

CVSS Base Metrics

CVSS v3 (3.x)

MEDIUM 6.4

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weaknesses (CWE)

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected & Patched Versions

Product	Affected Versions	Patched Version
RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg	N/A	N/A

📧Email Delivery — Threat intel straight to your inbox.

♾️Unlimited Vendors — Track your entire stack.

🚨All New CVEs — Be the first to know.

⚙️Custom EPSS — Filter noise, focus on risk.

💬Webhooks — Slack & Teams integration.

🚫Ad-Free — Uninterrupted experience.