Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV N L L R U H H H 8.0 .0041 33.4 —
AFFECTED Product Versions Fixed HT Menu unspecified —
TIMELINE Sep 2 Reserved by WPScan Sep 5 Published (CNA: WPScan) Sep 6 EXPLOIT PUBLISHED — CVE-2026-84935 (Unknown HT Menu). Public exploit reference added.
The HT Menu WordPress plugin before 1.2.7 does not perform any capability or object-ownership check when saving navigation menu-item settings, and does not escape those stored settings when the menu is rendered, allowing users with minimal permissions such as Subscribers to store JavaScript that executes in the browser of any visitor, administrators included, who views the affected menu.
| Date | Event | Detail |
|---|---|---|
| September 2, 2026 | Reserved | Reserved by WPScan |
| September 5, 2026 | Published | Published (CNA: WPScan) |
| September 6, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-84935 (Unknown HT Menu). Public exploit reference added. |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| Unknown | HT Menu | — | — | — |
Authoritative record: CVE-2026-84935 at cve.org
Weaknesses: CWE-79
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-84935 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
