WordPress Plugin Vulnerabilities

WP Mobile Menu 2.7.4 - 2.8.8 - Stored XSS via CSRF

Description

The plugin does not correctly verify the nonce on its settings import, so an attacker can import arbitrary plugin settings through a cross-site request in an administrator's session, and the imported values are then output unescaped to every visitor, resulting in Stored Cross-Site Scripting.

Proof of Concept

Affects Plugins

Plugin icon
mobile-menu
Fixed in 2.9

References

CVE
CVE-2026-91832

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Original Researcher
Het Kalariya
Submitter
Het Kalariya
Verified
Yes
WPVDB ID
9f1448d5-6dc9-47dd-8675-2fbf5f36393b

Timeline

Publicly Published
2026-09-28 (about 2 days ago)
Added
2026-09-28 (about 1 day ago)
Last Updated
2026-09-29 (about 9 hours ago)

Other

Published
Title
Published
2026-09-21
Title
WP Yelp Review Slider < 9.3 - Unauthenticated Stored Cross-Site Scripting via Yelp Review Text (imported via wpyelp_download_source)
Published
2014-08-01
Title
NextGEN Gallery <= 1.5.1 - Cross-Site Scripting (XSS)
Published
2024-10-07
Title
Bridge Core < 3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Published
2020-06-07
Title
SportsPress < 2.7.2 - Authenticated Stored Cross-Site Scripting
Published
2024-07-26
Title
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder < 5.1.20 - Authenticated (Administrator+) Stored Cross-Site Scripting