CVE-2026-84935

CVE-2026-84935 is a stored cross-site scripting (XSS) flaw in the HT Menu WordPress plugin, caused by the plugin failing to perform any capability or object-ownership check when navigation menu-item settings are saved and failing to escape those stored settings when the menu is rendered. As a result, any user with minimal permissions — as low as a Subscriber — can save JavaScript into menu-item settings, and that script executes in the browser of every visitor who views a page containing the affected menu, administrators included. An attacker whose injected script runs in an administrator's browser can steal session cookies or perform privileged actions, potentially leading to full site compromise. All WordPress sites running HT Menu before version 1.2.7 are affected, with the highest risk on sites that permit open user registration. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is currently known, and EPSS estimates only a 0.2% probability of exploitation within 30 days.

What to do: Update HT Menu to version 1.2.7 or later. Until patched, restrict which roles can save navigation menu-item settings and audit existing menu items for unexpected HTML or JavaScript; sites with open user registration should prioritize the update.