CVE-2026-91832 — WP Mobile Menu 2.7.4 - 2.8.8 - Stored XSS via CSRF
The WP Mobile Menu WordPress plugin before 2.9 does not correctly verify the nonce on its settings import, so an attacker can import arbitrary WP Mobile Menu WordPress plugin …
Published: 2026-09-30 · CVSS: 7.1 · CVSS 3.1
The WP Mobile Menu WordPress plugin before 2.9 does not correctly verify the nonce on its settings import, so an attacker can import arbitrary WP Mobile Menu WordPress plugin before 2.9 settings through a cross-site request in an administrator's session, and the imported values are then output unescaped to every visitor, resulting in Stored Cross-Site Scripting.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7