WordPress HT Menu plugin < 1.2.7 - Subscriber+ Stored XSS vulnerability

Subscriber+ Stored XSS vulnerability discovered by Artus KG in WordPress Plugin HT Menu versions 1.2.7...

CVE-2026-84935

The HT Menu WordPress plugin before 1.2.7 does not perform any capability or object-ownership check when saving navigation menu-item settings, and does not escape those stored settings when the menu is rendered, allowing users with minimal permissions such as Subscribers to store JavaScript that...

EUVD-2026-71874

The HT Menu WordPress plugin before 1.2.7 does not perform any capability or object-ownership check when saving navigation menu-item settings, and does not escape those stored settings when the menu is rendered, allowing users with minimal permissions such as Subscribers to store JavaScript that...

CVE-2026-84935 HT Menu < 1.2.7 - Subscriber+ Stored XSS via Menu Settings

The HT Menu WordPress plugin before 1.2.7 does not perform any capability or object-ownership check when saving navigation menu-item settings, and does not escape those stored settings when the menu is rendered, allowing users with minimal permissions such as Subscribers to store JavaScript that...

CVE-2026-84935 HT Menu < 1.2.7 - Subscriber+ Stored XSS via Menu Settings

The HT Menu WordPress plugin before 1.2.7 does not perform any capability or object-ownership check when saving navigation menu-item settings, and does not escape those stored settings when the menu is rendered, allowing users with minimal permissions such as Subscribers to store JavaScript that...

CVE-2026-84935

The HT Menu WordPress plugin (versions before 1.2.7 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The vulnerability exists because the plugin fails to perform capability or object-ownership checks when saving navigation menu-item settings and fails to escape stored settings during ...

PT-2026-86358

Name of the Vulnerable Software and Affected Versions HT Menu WordPress plugin versions prior to 1.2.7 Description Insufficient input sanitization and output escaping allow authenticated users with minimal permissions, such as Subscribers, to perform Stored Cross-Site Scripting XSS. The plugin...

CVE-2026-84935: Improper Neutralization of Input During Web Page Generation

The HT Menu WordPress plugin before 1.2.7 does not perform any capability or object-ownership check when saving navigation menu-item settings, and does not escape those stored settings when the menu is rendered, allowing users with minimal permissions such as Subscribers to store JavaScript that...

EUVD-2023-27877

Malicious code in bioql PyPI...

CVE-2023-23791

Cross-Site Request Forgery CSRF vulnerability in HasThemes HT Menu plugin = 1.2.1 versions...

CVE-2023-23791

Cross-Site Request Forgery CSRF vulnerability in HasThemes HT Menu plugin = 1.2.1 versions...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in HasThemes HT Menu plugin = 1.2.1 versions...

CVE-2023-23791 WordPress HT Menu Plugin <= 1.2.1 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in HasThemes HT Menu plugin = 1.2.1 versions...

CVE-2023-23791

Cross-Site Request Forgery CSRF vulnerability in HasThemes HT Menu plugin = 1.2.1 versions...

CVE-2023-23791

CVE-2023-23791 affects HasThemes HT Menu plugin for WordPress,

CVE-2023-23791 WordPress HT Menu Plugin <= 1.2.1 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in HasThemes HT Menu plugin = 1.2.1 versions...

WordPress Plugin HT Menu – WordPress Mega Menu Builder for Elementor 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress Plugin HT Menu - WordPress Mega...

PT-2023-19206 · Hasthemes · Ht Menu

Name of the Vulnerable Software and Affected Versions: HasThemes HT Menu plugin versions 1.2.1 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a we...

CVE-2023-23791: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in HasThemes HT Menu plugin = 1.2.1 versions...

WordPress HT Menu Plugin <= 1.2.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software HT Menu Type Plugin Vulnerable versions = 1.2.1 Fixed in 1.2.2 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-23791 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 4413b3296cb1 Credits István Márton Required...