CVE-2022-0628: Accesspressthemes Ap Mega Menu

Medium severity, CVSS 6.1. EPSS: 0.9% chance of exploitation in the next 30 days.

The Mega Menu WordPress plugin before 3.0.8 does not sanitize and escape the _wpnonce parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.

Affected products

• Accesspressthemes Ap Mega Menu: before 3.0.8 (fixed in 3.0.8)

Published 2022-03-21. Last modified 2026-06-17.