CVE-2026-11872

MediumCVSS 4.3/10Last modified Aug 26, 2026

Description

The Clever Mega Menu for Visual Composer WordPress plugin through 1.0.1 does not perform a nonce or capability check in an AJAX action that updates navigation menu item metadata, allowing any authenticated user, including Subscribers, to overwrite menu item content and settings that are rendered in the site's public navigation.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-284

Affected software

VendorProductVersions
UnknownClever Mega Menu for Visual Composer<= 1.0.1

References

Timeline

Published
Aug 2, 2026
Last modified
Aug 26, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1187208.8Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1187218.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1187228.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1187237.8Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2026-1187248.8Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1187258.8Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to elevate privileges over a network.CVE-2026-1187268.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1187276.5Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.CVE-2026-1187286.5Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.CVE-2026-1187298.8Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-118736.5An Apache-proxied Dogtag CA REST endpoint exposed by IdM (POST /ca/rest/certrequests) returns HTTP 500 with internal Java stack traces for uCVE-2026-1187308.8Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVE-2026-11872: Medium severity, CVSS 4.3 | Vulnix