CVE-2026-59559

MediumCVSS 6.5/10Last modified Oct 24, 2026

Description

Subscriber Cross Site Scripting (XSS) in RT Mega Menu – Mega Menu Builder for Elementor &amp; Gutenberg <= 1.5.1 versions.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jul 27, 2026
Last modified
Oct 24, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-59568.8Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Ankara Hosting Site Management Panel aCVE-2026-595606.5Subscriber Broken Access Control in FundEngine <= 1.7.8 versions.CVE-2026-595618.4Sakura Editor provided by Sakura Editor Development Community contains an OS command injection vulnerability. If a victim user is directed tCVE-2026-59562Missing authentication for critical function vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 2.0.0 before 2.0.11. CVE-2026-595634.6Zscaler MCP Server versions 0.7.0 and 0.7.1 has an issue where HMAC confirmation tokens were not bound to the target resource identifier, alCVE-2026-595649.1An authentication bypass issue exists in communications between affected versions of the Zscaler Client Connector and the Zscaler Client ConCVE-2026-595658.8A remotely exploitable buffer overflow bug can cause a local and kernel denial-of-service attack on affected versions of Zscaler Client ConnCVE-2026-595668.4A locally exploitable buffer overflow bug can cause a local denial-of-service attack on affected versions of Zscaler Client Connector on AndCVE-2026-595678.8Multiple vulnerabilities on affected versions of Zscaler Client Connector allow local privilege escalation, giving an unprivileged user the CVE-2026-595689.1Multiple vulnerabilities on affected versions of Zscaler Client Connector allow remote code execution, giving an unauthenticated, unprivilegCVE-2026-595698.1An improper input validation vulnerability in Zscaler Client Connector on Android and ChromeOS allows an attacker to potentially bypass ZscaCVE-2026-59576.5The EmailKit plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to and including 1.6.5. This is due to a flawed pa
CVE-2026-59559: Medium severity, CVSS 6.5 | Vulnix