WP Mega Menu
Avoid: vulnerability published 16 Sep 2026 still has no fix after 14 days.
Based on 3 of 5 areas
| Ownership | 100 |
|---|---|
| Maintenance | 0 |
| Security | 25 |
| Support | No data |
| Reputation | No data |
Active signals
Open issues right now, with links to the source.
- CriticalSEC-2Vulnerability published 16 Sep 2026 still has no fix after 14 days. Disable or replace the plugin. No fix has been released.30 Sep 2026Evidence
- CriticalSEC-2Vulnerability published 11 Dec 2024 still has no fix after 14 days. Disable or replace the plugin. No fix has been released.25 Dec 2024Evidence
- CriticalMNT-1No release in 60 months (last release 3 Nov 2021). Plan a replacement if the plugin is important to your site.3 Nov 2022Evidence
- WarningMNT-2Tested up to WordPress 5.8.19, 13 major versions behind 7.1.4. Plan a replacement if the plugin is important to your site.3 Nov 2026Evidence
History: 3 past vulnerabilities, 2 still unpatched in the current version. Patched issues are listed in the Security record, not here.
Quick answers
- Is WP Mega Menu still maintained?
- No. Last release 3 Nov 2021, over 5 years ago. 3 Nov 2021 · wordpress.org
- Who owns WP Mega Menu, and has it changed hands?
- No change recorded. 3 Nov 2026 · SVN log
- Was WP Mega Menu removed from wordpress.org?
- No. Listed on wordpress.org as of 3 Nov 2026. 3 Nov 2026 · wordpress.org
- Is WP Mega Menu safe?
- No. 2 known vulnerabilities have no fix in the current version. 16 Sep 2026 · Wordfence Intelligence
- Is the latest WP Mega Menu update safe to install?
- No ownership change before 1.4.2. No one-star spike after it. 3 Nov 2021 · Release history
Ownership timeline
Who commits to the plugin's code on wordpress.org, over time.
| themeum | 19 Jul 2017 to 3 Nov 2021, 72 commits |
|---|
1 committer recorded. No ownership changes recorded since 2017.
Maintenance
- Last release
- 5 years ago
- Releases, 24 months
- 0
- Tested up to
- 5.8 vs 7.1
- Requires PHP
- not stated supported 8.2+
| Q1 2024 | 0 |
|---|---|
| Q2 2024 | 0 |
| Q3 2024 | 0 |
| Q4 2024 | 0 |
| Q1 2025 | 0 |
| Q2 2025 | 0 |
| Q3 2025 | 0 |
| Q4 2025 | 0 |
| Q1 2026 | 0 |
| Q2 2026 | 0 |
| Q3 2026 | 0 |
| Q4 2026 | 0 |
Last release 3 Nov 2021. Tested up to 5.8, 13 major versions behind WordPress 7.1.
Support
- Resolved, last 2 months
- 0%
- Threads, last 2 months
- 1
Trend appears after 8 weekly snapshots.
Security record
2 vulnerabilities in 24 months (3 on record), 2 with no fix in the current version.
| Date | Issue | CVSS | Affected | Fixed in | Days to patch |
|---|---|---|---|---|---|
| 16 Sep 2026 | Authenticated (Administrator+) SQL Injection | 4.9 | <= 1.4.2 | No fix | n/a |
| 11 Dec 2024 | Authenticated (Administrator+) PHP Object Injection | 7.2 | <= 1.4.2 | No fix | n/a |
Show 1 patched vulnerability
| Date | Issue | CVSS | Affected | Fixed in | Days to patch |
|---|---|---|---|---|---|
| 20 Apr 2020 | Unauthenticated Settings Update to Stored Cross-Site Scripting | 6.5 | <= 1.3.6 | 1.3.7 | Same day |
Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.
Reputation
Last 90 days: no reviews. Lifetime: 4.4.
| Last 90 days | No reviews |
|---|---|
| Lifetime | 4.4 |
| 5 star | 177 |
|---|---|
| 4 star | 7 |
| 3 star | 7 |
| 2 star | 4 |
| 1 star | 24 |
Momentum
- Active installs
- 8,000+
- Downloads, last full week
- 182
| 4 May 2026 | 47 |
|---|---|
| 11 May 2026 | 84 |
| 18 May 2026 | 66 |
| 25 May 2026 | 77 |
| 1 Jun 2026 | 63 |
| 8 Jun 2026 | 74 |
| 15 Jun 2026 | 78 |
| 22 Jun 2026 | 68 |
| 29 Jun 2026 | 55 |
| 6 Jul 2026 | 74 |
| 13 Jul 2026 | 61 |
| 20 Jul 2026 | 75 |
| 27 Jul 2026 | 83 |
| 3 Aug 2026 | 101 |
| 10 Aug 2026 | 97 |
| 17 Aug 2026 | 90 |
| 24 Aug 2026 | 112 |
| 31 Aug 2026 | 92 |
| 7 Sep 2026 | 97 |
| 14 Sep 2026 | 127 |
| 21 Sep 2026 | 131 |
| 28 Sep 2026 | 123 |
| 5 Oct 2026 | 145 |
| 12 Oct 2026 | 134 |
| 19 Oct 2026 | 209 |
| 26 Oct 2026 | 182 |
Weekly downloads over the last 4 weeks are 71% above the 26-week average.
Healthier alternatives
Same job, rated Healthy, higher Canary Score. Never sponsored.
Facts
- Version
- 1.4.2
- Author
- Themeum
- Added
- 19 Jul 2017
- Last updated
- 3 Nov 2021
- Active installs
- 8,000+
- Requires WordPress
- 4.0
- Tested up to
- 5.8.19
- Requires PHP
- not stated
- Category
- Site Structure & Navigation > Menu Management & Mega Menus
- Tags
- megamenu, mega menu, navigation, wp-megamenu, responsive menu
Other plugins by this author: Kirki, Tutor LMS - eLearning and online course solution, Tutor LMS Elementor Addons, TutorMate, Qubely, WP Crowdfunding, Tutor LMS BunnyNet Integration, Tutor LMS Divi Modules, Tutor LMS - Migration Tool, Certificate customizer for Tutor LMS, Oxygen Tutor LMS, Growfund
Questions about WP Mega Menu
Is WP Mega Menu still maintained?
No. Last release 3 Nov 2021, over 5 years ago.
Who owns WP Mega Menu, and has it changed hands?
No change recorded.
Was WP Mega Menu removed from wordpress.org?
No. Listed on wordpress.org as of 3 Nov 2026.
Is WP Mega Menu safe?
No. 2 known vulnerabilities have no fix in the current version.
Is the latest WP Mega Menu update safe to install?
No ownership change before 1.4.2. No one-star spike after it.