WordPress Mobile Menu Plugin Stored XSS via Nonce Bypass

The WP Mobile Menu WordPress plugin before 2.9 does not correctly verify the nonce on its settings import, so an attacker can import arbitrary WP Mobile Menu WordPress plugin before 2.9 settings through a cross-site request in an administrator's session, and the imported values are then output unescaped to every visitor, resulting in Stored Cross-Site Scripting.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The WP Mobile Menu WordPress plugin before version 2.9 contains a critical vulnerability combining nonce verification bypass with stored cross-site scripting (XSS). An attacker can exploit the missing nonce validation on the settings import function to force administrators into importing malicious plugin configurations. Once imported, these settings are stored in the database and rendered without proper output escaping to all website visitors. This creates a persistent XSS payload that executes in every user's browser, potentially enabling credential theft, malware distribution, session hijacking, or complete site compromise. WordPress sites running the vulnerable plugin version are at immediate risk, particularly those with lower administrative security awareness.

Casky's 323 mapped skills detect this attack through Claude's analysis of MITRE ATT&CK techniques TA0001 (Initial Access) and TA0043 (Reconnaissance). Practitioners using Casky would observe findings related to: (1) unexpected administrative POST requests without valid nonce tokens in access logs, indicating the CSRF vector; (2) database queries showing injection of unescaped HTML/JavaScript into wp_options or plugin settings tables; (3) DOM-based XSS patterns in frontend page renders where settings are output; (4) suspicious import activities originating from external domains or unusual referrers. The skills framework would flag the gap between settings modification events and legitimate administrator activity, correlating CWE-79 (Improper Neutralization of Input During Web Page Generation) with the nonce validation failure to paint a complete attack picture for security teams.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-91832.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-91832

Casky has 323 skills that investigate the attack patterns behind CVE-2026-91832. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn