UNKNOWN NVD

CVE-2026-84935

The HT Menu WordPress plugin before 1.2.7 does not perform any capability or object-ownership check when saving navigation menu-item settings, and does not esc

The HT Menu WordPress plugin before 1.2.7 does not perform any capability or object-ownership check when saving navigation menu-item settings, and does not escape those stored settings when the menu is rendered, allowing users with minimal permissions such as Subscribers to store JavaScript that executes in the browser of any visitor, administrators included, who views the affected menu.

References

https://wpscan.com/vulnerability/10aeb456-764d-4f4d-a2c9-e357474d59c7/

Published: 2026-09-05 · Source: NVD · Feed updated: 2026-09-05

This unknown severity vulnerability was published on 2026-09-05 via NVD.

vulnfeed aggregates 10185 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.