CVE-2026-91832
WP Mobile Menu 2.7.4 - 2.8.8 - Stored XSS via CSRF
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The WP Mobile Menu WordPress plugin before 2.9 does not correctly verify the nonce on its settings import, so an attacker can import arbitrary WP Mobile Menu WordPress plugin before 2.9 settings through a cross-site request in an administrator's session, and the imported values are then output unescaped to every visitor, resulting in Stored Cross-Site Scripting.
| Vendor | unknown |
| Product | wp mobile menu |
| Published | Sep 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown wp mobile menu
Be the first to know when new unknown vulnerabilities affecting unknown wp mobile menu are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / WP Mobile Menu
2.7.4 < 2.9
References
Credits
Het Kalariya WPScan