plugin
9 known security issues reported for the Wp Megamenu WordPress plugin. Most recent disclosed Dec 13, 2024.
Running Wp Megamenu on your site? Check whether your installed version is affected.
Scan your site free[en] Deserialization of Untrusted Data vulnerability in Themeum WP Mega Menu allows Object Injection.This issue affects WP Mega Menu: from n/a through 1.4.2.
The WP Mega Menu plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.4.2 via deserialization of untrusted input. This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerab...
Arbitrary Post Access vulnerability discovered by WPScanTeam in WordPress WP Mega Menu plugin (versions <= 1.3.9).
Arbitrary Post Access vulnerability discovered by WPScanTeam in WordPress WP Mega Menu plugin (versions <= 1.4.0).
The WP Mega Menu plugin for WordPress is vulnerable to unauthenticated settings updates that can lead to stored cross-site scripting in versions up to, and including 1.3.6 due to a missing capability check and insufficient validation. This makes it possible for unauthenticated attackers to update the plugins settings a...
The WP Mega Menu plugin for WordPress is vulnerable to unauthenticated settings updates that can lead to stored cross-site scripting in versions up to, and including 1.3.6 due to a missing capability check and insufficient validation. This makes it possible for unauthenticated attackers to update the plugins settings a...
The plugin does not escape some URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting
The plugin does not properly check for capability and CSRF due to a logic flaw, in its export_theme() and export_wp_megamenu_nav_menu () methods, hooked to admin_init. As a result, unauthenticated users can call them and access arbitrary post data, including password protected or private ones.
The plugin does not properly check for capability and CSRF due to a logic flaw, in its export_theme() and export_wp_megamenu_nav_menu () methods, hooked as AJAX actions and available to any authenticated users. As a result, low privilege authenticated users such as subscribers can call them and access arbitrary post da...
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free