Threat Entry Updated 2026-03-30

CVE-2026-1032 - Conditional Menus Plugin

The Conditional Menus plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.6. This is due to missing nonce validation on the 'save_options' function. This makes it possible for unauthenticated attackers to modify conditional menu assignments via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

PLUGIN Conditional Menus

CVE-2026-1032

MEDIUM CVSS 4.3 2026-03-26

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-12-12

CVE-2023-2654 - Conditional Menus Plugin

The Conditional Menus WordPress plugin before 1.2.1 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

PLUGIN Conditional Menus

CVE-2023-2654

MEDIUM CVSS 6.1 2023-06-19

Risk Score

Open Full Technical Breakdown