RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg

RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg has 5 disclosed vulnerabilities in the WordSec catalog, all reported in 2026; 4 are fixed and 1 remains unpatched as of October 2026. Their average CVSS score is 6.0, and the most serious one scores 6.4 out of 10. 2026 was the busiest year with 5 disclosures.

The most common weakness is Cross-Site Scripting, behind 4 of the records (80%). Other recurring categories include Missing Authorization.

4 of the records (80%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2026.

5 independent researchers contributed these findings, one record each.

Strategic Overview

Avg CVSSMedium

6.0/ 10

Patch Coverage80%

Open

Fixed

Get automatic notifications for all RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg vulnerabilities before they are exploited.

Most severe open issueCVSS 6.4CVE-2026-15650

RT Mega Menu <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pointer_menu_item' Block Attribute

Read the full analysis

Vulnerability Records

5 records


2026-09-17 14:08	RT Mega Menu <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pointer_menu_item' Block Attribute RT Mega Menu <= 1.5.2	`CVE-2026-15650`	6.4 Medium	Wordfence PRISM	No
2026-09-17 14:08	RT Mega Menu <= 1.5.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via rtmega_update_menu_options AJAX Action RT Mega Menu <= 1.5.1	`CVE-2026-14855`	6.4 Medium	Mitchell	Yes
2026-07-27 00:00	RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg <= 1.5.1 - Missing Authorization RT Mega Menu <= 1.5.1	`CVE-2026-65433`	4.3 Medium	luc	Yes
2026-07-27 00:00	RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg <= 1.5.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting RT Mega Menu <= 1.5.1	`CVE-2026-59559`	6.4 Medium	anhcd05	Yes
2026-07-20 00:00	RT Mega Menu <= 1.5.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting RT Mega Menu <= 1.5.1	`CVE-2026-15385`	6.4 Medium	Shivamani Vastrala	Yes

Showing 1–5 of 5 reports