Max Mega Menu
Max Mega Menu has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2017 and 2024; all 2 are fixed as of September 2026. Their average CVSS score is 5.2, and the most serious one scores 6.1 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (50%). Other recurring categories include Missing Authorization.
Every one of the 2 issues recorded for Max Mega Menu has a vendor fix available, so running the current release closes all known holes.
All of these findings were reported by Rafie Muhammad. Max Mega Menu is installed on roughly 300,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2017-18525Max Mega Menu <= 2.3.8 - Authenticated Cross-Site Scripting
Read the full analysisVulnerability Records

Max Mega Menu
Author
megamenu
Max Mega Menu is a complete menu management plugin for WordPress, built for the block editor, page builders and classic themes. Create new menus from scratch or enhance your existing ones. With Max Mega Menu you can add WordPress widgets, blocks or custom HTML to your sub menus, style everything with the built in theme editor, and fine tune behaviour with powerful settings. Place menus via a block, page builder element (Bricks, Breakdance, Divi & Elementor), shortcode, widget or wp_nav_menu. The result is a light weight, user friendly, accessible and touch ready mega menu with just a few clicks. Documentation & Demo: https://www.megamenu.com Mobile Native touch event support Built-in off-canvas mobile menu option Set your own responsive breakpoint For items with sub-menus, control what happens on first and second tap – open/close or open/follow link Option to hide sub-menus on mobile Customisable mobile toggle bar – adjust elements to match your site design Features Extends the native WordPress menu system Restores the Appearance > Menus screen in full site editing themes Supports multiple menu locations, each with its own configuration Fully customise menu styling with the built in theme editor Google Font support via integration with the WordPress 7.0 Font Library Organise sub-menu content into rows and columns with the grid layout builder Display any WordPress widget or Block Pattern in your menu Traditional Flyout or Mega Menu sub-menu styles Hover, hover intent, or click to open sub-menus Sub-menu transitions: fade, fade up, slide up, or slide Add icons to menu items Per item options: hide text, disable link, hide on mobile and more Align items to the left or right of the menu bar Align sub-menus to the left or right of their parent item Off-canvas (slide in from left or right) or standard dropdown mobile menu Place your menu via block, widget, shortcode, or automatic integration Native modules for Bricks, Breakdance, Divi & Elementor Accessibility Keyboard Navigation built in TAB activates keyboard navigation and navigates through the menu on both desktop and mobile ENTER or SPACE on a sub menu arrow indicator shows/hides the sub menu ESC closes all open sub menus Max Mega Menu is developed with a focus on code quality, performance and usability. No !important, inline or block CSS – menu locations are styled via a single static CSS file Less than 2kb of JavaScript (gzipped) Responsive, touch and retina ready Keyboard navigation supported Tested across all modern desktop and mobile browsers Low memory footprint Supports all core nav_menu_* filters (prefix with mega_) In-depth documentation included Basic support included with the free version Pro Features: Sliding Panels Mobile Menu Tabbed Mega Menus Sticky Menu Vertical & Accordion Menus Font Awesome & Custom Icons Custom Item Styling Menu Logo Search Box WooCommerce & EDD support Roles & Restrictions Extended mobile toggle blocks Automatic updates Priority Support Find out more: https://www.megamenu.com/upgrade/
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C