The RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin contains a stored cross-site scripting flaw that permits a user with subscriber privileges to inject malicious JavaScript into menu definitions. Once stored, the code runs whenever the affected menu is rendered on any page, exposing every site visitor to the attacker’s script. This can lead to session hijacking, defacement, or data exfiltration, compromising the confidentiality, integrity, and availability of the website.

All WordPress installations that use the themewant RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin version 1.5.1 or earlier are impacted. The vulnerability manifests in the plugin’s menu‑building feature accessed through the WordPress admin interface.

The CVSS score of 6.5 indicates a moderate severity and the EPSS score of less than 1% suggests a very low probability of exploitation; the flaw is not listed in the CISA KEV catalog. The likely attack vector requires a subscriber with permission to create or edit menu items; by injecting a malicious script into a menu definition, the attacker stores the payload, which is then executed in any visitor’s browser when the menu renders.