WordPress Plugin Vulnerabilities

WP Mega Menu < 1.4.1 - Reflected Cross-Site Scripting

Description

The plugin does not escape some URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting

Proof of Concept

Affects Plugins

Plugin icon
wp-megamenu
Fixed in 1.4.1

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.1 (medium)

Miscellaneous

Original Researcher
WPScanTeam
Verified
Yes
WPVDB ID
9d698bab-5882-4e30-aca2-2e2fcaa36236

Timeline

Publicly Published
2021-09-17 (about 4 years ago)
Added
2022-06-07 (about 3 years ago)
Last Updated
2022-06-07 (about 3 years ago)

Other

Published
Title
Published
2025-07-18
Title
Live Stream Badger <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-09-06
Title
UDesign Core <= 4.14.0 - Reflected Cross-Site Scripting
Published
2021-06-15
Title
Smooth Scroll Page Up/Down Buttons < 1.4.1 - Authenticated Stored XSS via psb_positioning
Published
2024-01-17
Title
Essential Addons for Elementor < 5.9.5 - Contributor+ Stored Cross-Site Scripting via Image URl
Published
2024-02-29
Title
Visual Composer Premium < 45.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting