WordPress plugin Hero Mega Menu has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2025-9809

Name of the Vulnerable Software and Affected Versions The Hero Mega Menu - Responsive WordPress Menu Plugin versions up to, and including, 1.16.5 Description The issue is related to Reflected Cross-Site Scripting due to insufficient input sanitization and output escaping, specifically via the ind...

CVE-2024-13779: Improper Neutralization of Input During Web Page Generation

The Hero Mega Menu - Responsive WordPress Menu Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'index' parameter in all versions up to, and including, 1.16.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2024-13780: Missing Authorization

The Hero Mega Menu - Responsive WordPress Menu Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the hmenudeletemenu function in all versions up to, and including, 1.16.5. This makes it possible for unauthenticated attackers to delete...

CVE-2024-13778: Improper Neutralization of Special Elements used in an SQL Command

The Hero Mega Menu - Responsive WordPress Menu Plugin plugin for WordPress is vulnerable to SQL Injection via several functions in all versions up to, and including, 1.16.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...

PT-2025-9810

Name of the Vulnerable Software and Affected Versions The Hero Mega Menu - Responsive WordPress Menu Plugin versions up to, and including, 1.16.5 Description The issue arises from insufficient file path validation in the hmenu delete menu function, allowing unauthenticated attackers to delete...

WordPress plugin Hero Mega Menu has a SQL injection vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerabili...

WordPress plugin Hero Mega Menu has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exist...

PT-2025-9808

Name of the Vulnerable Software and Affected Versions The Hero Mega Menu - Responsive WordPress Menu Plugin versions up to, and including, 1.16.5 Description The issue arises from insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query,...

WordPress Hero Mega Menu - Responsive WordPress Menu Plugin plugin <= 1.16.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Directory Deletion vulnerability

WordPress Hero Mega Menu - Responsive WordPress Menu Plugin plugin = 1.16.5 - Missing Authorization to Authenticated Subscriber+ Arbitrary Directory Deletion vulnerability discovered by Lucio Sá in WordPress Plugin Hero Mega Menu - Responsive WordPress Menu Plugin versions = 1.16.5...

CVE-2025-23881

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in littlejon LJ Custom Menu Links lj-custom-menu-links allows Reflected XSS.This issue affects LJ Custom Menu Links: from n/a through = 2.5...

CVE-2025-23881

CVE-2025-23881 concerns the WordPress plugin LJ Custom Menu Links (versions

CVE-2025-23881 WordPress LJ Custom Menu Links Plugin <= 2.5 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in littlejon LJ Custom Menu Links lj-custom-menu-links allows Reflected XSS.This issue affects LJ Custom Menu Links: from n/a through = 2.5...

PT-2025-9418

Name of the Vulnerable Software and Affected Versions LJ Custom Menu Links versions n/a through 2.5 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. Recommendations For versions n/a...

CVE-2025-23881: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in littlejon LJ Custom Menu Links lj-custom-menu-links allows Reflected XSS.This issue affects LJ Custom Menu Links: from n/a through = 2.5...

select-menu.php Code Execution

The vulnerability of the select-menu.php web system for the online reservation system of the Multi Restaurant Table Reservation System is related to the lack of measures taken to protect the SQL query structure when processing the table parameter. Exploiting this vulnerability allows an attacker ...

CVE-2025-26925

Cross-Site Request Forgery CSRF vulnerability in Required Admin Menu Manager allows Cross Site Request Forgery.This issue affects Admin Menu Manager: from n/a through 1.0.3...

PT-2025-8988

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. Description General information about the issue is not explicitly mentioned, but it is related to a security advisory from Lenovo. The estimated number of potentially affected devices worldwide is not...

CVE-2025-26925

Cross-Site Request Forgery CSRF vulnerability in Required Admin Menu Manager allows Cross Site Request Forgery.This issue affects Admin Menu Manager: from n/a through 1.0.3...

CVE-2025-26925 WordPress Admin Menu Manager plugin <= 1.0.3 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Required Admin Menu Manager allows Cross Site Request Forgery.This issue affects Admin Menu Manager: from n/a through 1.0.3...