Conditional Menus Vulnerabilities

Cross-Site Request Forgery to Menu Options Update vulnerability

CVSS:

4.3

Affected:

up to 1.2.6

Fixed in:

1.2.7

Disclosed:

Mar 30, 2026

The Conditional Menus plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.6. This is due to missing nonce validation on the 'save_options' function. This makes it possible for unauthenticated attackers to modify conditional menu assignments via a forged request gra...

CVSS:

4.3

Affected:

up to 1.2.6

Fixed in:

1.2.7

Disclosed:

Mar 25, 2026

CVE-2026-1032 on NVD →

The Conditional Menus plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'current_page' and 'num_of_pages ' parameters in versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary w...

CVSS:

6.1

Affected:

up to 1.2.0

Fixed in:

1.2.1

Disclosed:

May 24, 2023

CVE-2023-2654 on NVD →