WP Mega Menu

WP Mega Menu has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2020 and 2026; 1 is fixed and 2 remain unpatched as of October 2026. Their average CVSS score is 6.2, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 1 high.

The most common weakness is Cross-Site Scripting, behind 1 of the records (33%). Other recurring categories include Deserialization Of Untrusted Data, SQL Injection.

1 of the records (33%) have a vendor fix, while 2 remain unpatched. The oldest unresolved one dates back to 2024.

2 independent researchers contributed these findings, one record each.

01234567891020.04.2020Today20.04.20206.5WP Mega Menu <= 1.3.6 - Unauthenticated Settings Update to Stored Cross-Site Scripting CVSS 6.5 · 20.04.202011.12.20247.2WP Mega Menu <= 1.4.2 - Authenticated (Administrator+) PHP Object Injection CVSS 7.2 · 11.12.202416.09.20264.9WP Mega Menu <= 1.4.2 - Authenticated (Administrator+) SQL Injection CVSS 4.9 · 16.09.2026

Strategic Overview

Avg CVSSMedium
6.2/ 10
Patch Coverage33%
Open

2

Fixed

1

Get automatic notifications for all WP Mega Menu vulnerabilities before they are exploited.

Most severe open issueCVSS 7.2CVE-2024-54282

WP Mega Menu <= 1.4.2 - Authenticated (Administrator+) PHP Object Injection

Read the full analysis

Vulnerability Records

3 records
Showing 1–3 of 3 reports

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C