The HT Menu WordPress plugin allows users with minimal permissions, such as Subscribers, to create JavaScript payloads stored within menu‑item settings. Because the plugin performs neither a capability nor an object‑ownership check before saving nor escapes those stored values when rendering the menu, an attacker can inject code that executes in the browser of every visitor who loads the affected menu, including site administrators. This enables classic XSS attacks such as cookie theft, session hijacking, or defacement of the site’s content.

The vulnerability exists in all installations of the HT Menu plugin dated before version 1.2.7. Sites running any earlier release of this plugin are impacted, regardless of other security controls, as the attack vector relies on the plugin’s menu‑setting UI which is accessible to low‑privilege users.

The exploit is straightforward: an authenticated Subscriber can edit a menu item and embed malicious code. No additional privileges are required beyond that role, and the plugin stores the data unescaped. The CVSS score of 8 and EPSS score of less than 1% indicate a high severity vulnerability with low expected exploitation probability, but the practical exploitability remains high because the attack is carried out through normal administrative interfaces and the injected code runs in the context of all site visitors. The vulnerability is not listed in the CISA KEV catalog, but its impact could be severe for high‑traffic sites.