A stored Cross-Site Scripting (XSS) vulnerability in the HT Menu WordPress plugin allows authenticated users to execute malicious scripts in the browsers of site visitors and administrators.

The plugin suffers from a Stored Cross-Site Scripting (CWE-79) vulnerability because it lacks necessary capability checks and output escaping when saving navigation menu settings. This allows an authenticated user with minimal permissions, such as a Subscriber, to inject arbitrary JavaScript that executes when the menu is rendered.

This vulnerability poses a significant risk to organizational security by enabling session hijacking, unauthorized actions on behalf of administrators, and potential site defacement. With a CVSS score of 8.0, the high severity reflects the potential for full compromise of user sessions if a privileged administrator views a poisoned menu, leading to broader unauthorized access within the WordPress environment.

Immediate Action: Update the HT Menu WordPress plugin to version 1.2.7 or later immediately to apply the required capability checks and output sanitization.

Proactive Monitoring: Review WordPress access logs for suspicious activity originating from low-privileged user accounts, specifically monitoring for unusual POST requests directed at menu-item configuration endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block malicious script injection attempts, providing a temporary layer of defense while the update is staged.

Public Exploit Available: Unknown

Given the high CVSS score and the potential for privilege escalation via session theft, administrators should prioritize this update within their standard maintenance cycle. Ensure that all plugins are updated to the latest available versions and verify that user roles are restricted to the minimum necessary permissions to limit the surface area for such attacks.