CVE-2026-22349: 
WordPress vulnerability analysis and mitigation

CVE-2026-22349 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the WordPress plugin "Menu In Post" developed by linux4me2. It affects all versions of the plugin up to and including version 1.5.0 (with the CVE description referencing versions through 1.4.1). The vulnerability was reported on November 30, 2025, by researcher Muhammad Yudha - DJ, disclosed by Patchstack on December 30, 2025, and published to NVD on January 22, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium), assigned by Patchstack (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically manifesting as DOM-Based XSS. This type of XSS occurs when client-side JavaScript dynamically writes attacker-controlled data to the DOM without proper sanitization or encoding, allowing malicious scripts to execute in a victim's browser. Exploitation requires the attacker to have at least Contributor-level privileges on the WordPress site and requires a privileged user to interact with a crafted page or link (user interaction required). No public proof-of-concept code has been identified at this time (Patchstack).

Successful exploitation allows an attacker to inject and execute arbitrary JavaScript in the context of a victim's browser session on the affected WordPress site. This can lead to session hijacking, credential theft, unauthorized actions performed on behalf of the victim, redirection to malicious sites, or defacement of web content visible to site visitors. The scope is changed (S:C), meaning the impact extends beyond the vulnerable component to the victim's browser environment, with low confidentiality, integrity, and availability impacts (Patchstack).

No evidence of active in-the-wild exploitation has been reported for CVE-2026-22349. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. No exploit kits or weaponized code have been publicly identified, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority with low likelihood of exploitation (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Menu In Post plugin (versions ≤ 1.5.0) using tools like WPScan or by inspecting page source for plugin references.
2. Obtain Contributor access: Register or compromise a Contributor-level (or higher) account on the target WordPress site, as this privilege level is required to inject content.
3. Craft malicious payload: Create a post or content element using the Menu In Post plugin that includes a DOM-Based XSS payload (e.g., injecting unsanitized input into a plugin shortcode or menu parameter that is later processed by client-side JavaScript).
4. Deliver to victim: Trick a privileged user (e.g., administrator or editor) into visiting the crafted page or clicking a malicious link that triggers the DOM manipulation.
5. Execute payload: The victim's browser processes the malicious JavaScript, enabling session token theft, credential harvesting, or other client-side attacks (Patchstack).

• Logs: WordPress access logs showing unusual POST or GET requests to pages using the Menu In Post plugin shortcode with unexpected script-like parameters or encoded payloads.
• File System: Unexpected modifications to plugin files in wp-content/plugins/menu-in-post/ that may indicate tampering.
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting pages with Menu In Post content, potentially indicating data exfiltration via injected scripts.
• Browser/Application: Reports from users of unexpected redirects, pop-ups, or unauthorized actions occurring on pages that use the Menu In Post plugin.

As of the time of disclosure, no official patched version of the Menu In Post plugin was available from the developer (Patchstack). Site administrators should consider deactivating and removing the plugin until a patch is released. As a compensating control, restrict Contributor-level user registration and audit existing contributor accounts. Patchstack subscribers may benefit from virtual patching to block exploitation attempts without requiring a plugin update.

The vulnerability was discovered and responsibly disclosed by researcher Muhammad Yudha - DJ through Patchstack's coordinated disclosure process. Patchstack classified it as low priority with limited exploitation likelihood. No significant broader media coverage or notable researcher commentary beyond the Patchstack advisory has been identified (Patchstack).