CVE-2026-59559

MediumCVSS 6.5

Published: 27/07/2026(UTC)Updated: 24/10/2026(UTC)Translated: 27/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

12th percentile - higher than 12% of all known CVEs

Summary

The RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin version 1.5.1 and earlier contains a Cross Site Scripting (XSS) vulnerability exploitable by Subscriber-level users. An attacker can inject malicious scripts.

Risk Assessment

The risk involves potential execution of malicious scripts in other users' browsers, which could lead to session theft, redirects, or data theft.

Recommendation

Update the RT Mega Menu plugin to the latest version that fixes this vulnerability.

Other vulnerabilities in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg

CVE-2026-65433Medium
The RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin version 1.5.1 and earlier contains a broken access control vulnerability exploitable by Subscriber-level users. An attacker can gain unauthorized access to functions.

Original NVD description (English source)

Subscriber Cross Site Scripting (XSS) in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg <= 1.5.1 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS