CVE-2026-105602

Joomla Extension - joomshaper.com - Stored Cross-Site Scripting XSS in Mega Menu Badge Text in Helix Ultimate 2.2.11...

CVE-2026-105602 Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in Mega Menu Badge Text in Helix Ultimate < 2.2.11.

Joomla Extension - joomshaper.com - Stored Cross-Site Scripting XSS in Mega Menu Badge Text in Helix Ultimate 2.2.11...

EUVD-2026-115176

Joomla Extension - joomshaper.com - Stored Cross-Site Scripting XSS in Mega Menu Badge Text in Helix Ultimate 2.2.11...

CVE-2026-105602

The Helix Ultimate Joomla extension by joomshaper.com is vulnerable to Stored Cross-Site Scripting (XSS) in versions prior to 2.2.11 . The vulnerability exists within the Mega Menu Badge Text component, where improper neutralization of input allows for malicious script execution. This issue is as...

CVE-2026-105602 Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in Mega Menu Badge Text in Helix Ultimate < 2.2.11.

Joomla Extension - joomshaper.com - Stored Cross-Site Scripting XSS in Mega Menu Badge Text in Helix Ultimate 2.2.11...

CVE-2026-105602: joomshaper.com Helix Ultimate extension for Joomla: Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in Mega Menu Badge Text in Helix Ultimate <…

Joomla Extension - joomshaper.com - Stored Cross-Site Scripting XSS in Mega Menu Badge Text in Helix Ultimate 2.2.11...

PT-2026-135424

Joomla Extension - joomshaper.com - Stored Cross-Site Scripting XSS in Mega Menu Badge Text in Helix Ultimate 2.2.11...

CVE-2026-14855

The RT Mega Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cssleft' parameter in all versions up to, and including, 1.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access a...

CVE-2026-15650

The RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'pointermenuitem' Block Attribute in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-14855

The RT Mega Menu WordPress plugin (all versions up to and including 1.5.1 ) is vulnerable to Stored Cross-Site Scripting (XSS) through the css[left] parameter, processed via the rtmega_update_menu_options AJAX action. The root cause is insufficient input sanitization and output escaping . Authent...

EUVD-2026-82644

The RT Mega Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cssleft' parameter in all versions up to, and including, 1.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access a...

CVE-2026-14855 RT Mega Menu <= 1.5.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via rtmega_update_menu_options AJAX Action

The RT Mega Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cssleft' parameter in all versions up to, and including, 1.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access a...

CVE-2026-14855 RT Mega Menu <= 1.5.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via rtmega_update_menu_options AJAX Action

The RT Mega Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cssleft' parameter in all versions up to, and including, 1.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access a...

CVE-2026-15650 RT Mega Menu <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pointer_menu_item' Block Attribute

The RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'pointermenuitem' Block Attribute in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-15650 RT Mega Menu <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pointer_menu_item' Block Attribute

The RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'pointermenuitem' Block Attribute in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-15650

The RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg WordPress plugin (versions ≤ 1.5.2) is vulnerable to an authenticated stored cross-site scripting (XSS) via the pointer_menu_item block attribute. The root cause is insufficient input sanitization and output escaping : the payload byp...

EUVD-2026-82643

The RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'pointermenuitem' Block Attribute in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-95222

Name of the Vulnerable Software and Affected Versions RT Mega Menu versions prior to 1.5.2 Description Insufficient input sanitization and output escaping allow authenticated attackers with Subscriber-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecting...

CVE-2026-14855: Improper Neutralization of Input During Web Page Generation

The RT Mega Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cssleft' parameter in all versions up to, and including, 1.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access a...

CVE-2026-15650: Improper Neutralization of Input During Web Page Generation

The RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'pointermenuitem' Block Attribute in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for...