WordPress security by component
RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg
Plugin description
RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg is a WordPress component with 2 published CVE records in this archive. The latest tracked vulnerability was published Jul 27, 2026; the highest CVE/CNA score is 6.5.
Plugin slug:
rt-mega-menuLatest vulnerability
CVE-2026-65433: RT Mega Menu subscribers can reach a privileged operation
RT Mega Menu through 1.5.1 lets a Subscriber reach a plugin operation without the required capability or ownership check. The Patchstack CNA record does not disclose the endpoint, action, parameter, function, protected object or concrete operation, so the exact integrity or confidentiality impact remains unknown.
| Safe version |
|
||
|---|---|---|---|
| Jul 27, 2026 |
CVE-2026-65433
RT Mega Menu subscribers can reach a privileged operation
RT Mega Menu through 1.5.1 lets a Subscriber reach a plugin operation without the required capability or ownership check. The Patchstack CNA record does not disclose the endpoint, action, parameter, function, protected object or concrete operation, so the exact integrity or confidentiality impact remains unknown.
|
1.5.2 |
CVE6.5
NVDPending
|
| Jul 27, 2026 |
CVE-2026-59559
RT Mega Menu subscriber input permits cross-site scripting
RT Mega Menu through 1.5.1 lets a Subscriber supply attacker-controlled input that reaches a browser-executable output context without adequate neutralization. The payload can execute in the site's origin when another user views the crafted output. The Patchstack CNA record does not disclose whether the payload is reflected or stored, or identify the endpoint, field, parameter or rendering function.
|
1.5.2 |
CVE6.5
NVDPending
|