Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.1
CVE-2026-91832: WP Mobile Menu plugin can let attackers add hidden code
CVE-2026-91832 · published 1 month ago
Summary
The WP Mobile Menu add‑on for WordPress (versions up to 2.8.8) does not properly check a security token when importing settings. An attacker who tricks an admin into loading a crafted page can cause malicious code to be saved and then shown to any visitor. Update the plugin to the latest version or remove it if you cannot apply the update.
What to do
- Update unknown wp mobile menu to version 2.9 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | wp mobile menu | < 2.9 |
Original advisory text
WP Mobile Menu 2.7.4 - 2.8.8 - Stored XSS via CSRF
The WP Mobile Menu WordPress plugin before 2.9 does not correctly verify the nonce on its settings import, so an attacker can import arbitrary WP Mobile Menu WordPress plugin before 2.9 settings through a cross-site request in an administrator's session, and the imported values are then output unescaped to every visitor, resulting in Stored Cross-Site Scripting.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
7.1
High
Type
CWE-79Cross-site Scripting (XSS)
CWE-352Cross-Site Request Forgery (CSRF)
Timeline
Published30 Sep 2026
Updated2 Oct 2026
First seen30 Sep 2026
Track software like this
Free during beta