CVE-2026-14855

Name of the Vulnerable Software and Affected Versions RT Mega Menu versions prior to 1.5.2

Description Insufficient input sanitization and output escaping allow authenticated attackers with Subscriber-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecting arbitrary web scripts via the css[left] parameter, which then execute when a user visits the affected page.

Recommendations Update the plugin to a version newer than 1.5.1. As a temporary mitigation, restrict access to the css[left] parameter for users with Subscriber-level permissions.