CVE-2026-59559 in RT Mega Menu Plugin
Summary
by MITRE • 07/27/2026
Subscriber Cross Site Scripting (XSS) in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg <= 1.5.1 versions.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/27/2026
The RT Mega Menu plugin for Elementor and Gutenberg versions 1.5.1 and earlier contain a subscriber cross site scripting vulnerability that presents significant security risks to WordPress websites utilizing these plugins. This vulnerability allows authenticated users with subscriber-level permissions to execute malicious scripts within the context of other users' browsers, potentially leading to unauthorized actions and data theft.
The technical flaw resides in improper input validation and output escaping mechanisms within the plugin's menu rendering functionality. When processing user-submitted menu item data, the plugin fails to adequately sanitize and escape dynamic content before displaying it on web pages, creating an XSS attack surface where malicious scripts can be injected through menu configuration parameters. This vulnerability specifically affects the plugin's handling of menu item titles, URLs, and custom attributes that are processed without sufficient security measures.
The operational impact of this vulnerability is substantial as it enables attackers with subscriber accounts to compromise other users within the same WordPress installation. An attacker could inject malicious JavaScript code into menu items that would execute whenever other users view the affected pages, potentially stealing session cookies, redirecting users to malicious sites, or performing unauthorized actions on behalf of logged-in users. The vulnerability affects not only the immediate site but also any connected services or applications that rely on the compromised WordPress installation for authentication or data access.
This vulnerability maps to CWE-79 - Cross-site Scripting and aligns with ATT&CK technique T1566.002 - Phishing: Spearphishing Attachment, as it enables attackers to create malicious menu items that can be exploited through social engineering. The attack vector specifically relates to credential access through browser-based attacks rather than network-level exploitation.
Mitigation strategies should include immediate plugin updates to version 1.5.2 or later where the XSS vulnerability has been addressed through proper input sanitization and output escaping mechanisms. Administrators should also implement additional security measures such as role-based access controls, regular security audits of installed plugins, and monitoring for suspicious menu modifications. Network-level protections including web application firewalls and content security policies can provide additional defense in depth. Regular vulnerability scanning and penetration testing should be conducted to identify similar issues in other plugins or themes that may expose similar XSS vulnerabilities through improper input handling or output encoding failures.