The HT Menu WordPress plugin allows users with minimal permissions, such as Subscribers, to create JavaScript payloads stored within menu‑item settings. Because the plugin performs neither a capability nor an object‑ownership check before saving nor escapes those stored values when rendering the menu, an attacker can inject code that executes in the browser of every visitor who loads the affected menu, including site administrators. This enables classic XSS attacks such as cookie theft, session hijacking, or defacement of the site’s content.

The vulnerability exists in all installations of the HT Menu plugin dated before version 1.2.7. Sites running any earlier release of this plugin are impacted, regardless of other security controls, as the attack vector relies on the plugin’s menu‑setting UI which is accessible to low‑privilege users.

The exploit is straightforward: an authenticated Subscriber can edit a menu item and embed malicious code. No additional privileges are required beyond that role, and the plugin stores the data unescaped. Although a dedicated CVSS score and EPSS value are not available, the practical exploitability is high because the attack is performed through normal administrative interfaces and the injected code runs in the context of all site visitors. The vulnerability is not listed in the CISA KEV catalog, but its impact could be severe for high‑traffic sites.