CVE-2026-84935

HighCVSS 8.0/10Last modified Sep 8, 2026

Description

The HT Menu WordPress plugin before 1.2.7 does not perform any capability or object-ownership check when saving navigation menu-item settings, and does not escape those stored settings when the menu is rendered, allowing users with minimal permissions such as Subscribers to store JavaScript that executes in the browser of any visitor, administrators included, who views the affected menu.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	HT Menu	< 1.2.7

References

https://wpscan.com/vulnerability/10aeb456-764d-4f4d-a2c9-e357474d59c7/

Timeline

Published: Sep 5, 2026
Last modified: Sep 8, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-849365.3The EmbedPress WordPress plugin before 4.6.4 does not have proper authorization on a public review-loading action, allowing unauthenticated CVE-2026-849376.8The Video Player for YouTube WordPress plugin before 2.1.0 does not properly sanitise and escape user-supplied input before using it in a S CVE-2026-849399.1Path traversal vulnerability in Apache FreeMarker template loading mechanism, if the attacker can specify an arbitrary malformed locale iden CVE-2026-84946.4The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in the admin URI Editor interfa CVE-2026-849416.9An information disclosure vulnerability in the SAML Single Sign-On (SSO) functionality of Omada Controller allows an authenticated user with CVE-2026-849428.7Improper input validation in the Vega expression function implementation in OpenSearch Dashboards allows a remote authenticated actor with d CVE-2026-849475.3undici's dump interceptor reads and discards a response body up to a configurable maximum size. When a response declares a Content-Length th CVE-2026-84959.8Missing Authorization vulnerability in Drupal Date iCal allows Forceful Browsing. This issue affects Date iCal: from 0.0.0 before 4.0.15.CVE-2026-84966.1A cross-site scripting (XSS) vulnerability exists in Alinto SOGo, version 5.12.7. A maliciously crafted ICS calendar invitation files allow CVE-2026-849606.1The WP-Members Membership Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL Query String in all versions u CVE-2026-849619.1undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as CVE-2026-849624.2An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls