The RT Mega Menu WordPress plugin prior to 1.5.2 fails to verify user permissions before accepting configuration changes via an AJAX action. Any logged‑in subscriber can submit arbitrary style values for menu items that are inserted directly into a style attribute on the public navigation without escaping. An attacker can break out of the attribute and embed a JavaScript event handler that runs for every visitor who hovers the menu, potentially hijacking sessions across the whole site.

All WordPress sites that use RT Mega Menu before version 1.5.2, especially those where subscribers have permission to edit menus. The vulnerability is present in any installation that has not yet been updated to 1.5.2 or newer.

The flaw is a stored cross‑site scripting issue and can be triggered by any user with a subscriber role. The exploit requires only a logged‑in account and no additional external input, so the attack vector is internal authenticated. The EPSS score is below 1 % and the vulnerability is not listed in CISA KEV, but the potential impact of session takeover warrants immediate attention. The CVSS score of 5.4 indicates moderate severity.