CVE-2026-14855

The RT Mega Menu WordPress plugin (all versions up to and including 1.5.1 ) is vulnerable to Stored Cross-Site Scripting (XSS) through the css[left] parameter, processed via the rtmega_update_menu_options AJAX action. The root cause is insufficient input sanitization and output escaping . Authent...