Vulnerability · Published Apr 5, 2021 · Assigned by WPScan
CVE-2021-24162Responsive Menu < 4.0.4 - CSRF to Settings Update
High 8.8
In plain English
A high-severity cross-site request forgery in Responsive Menu – Create Mobile-Friendly Menu from ExpressTech. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities).
Severity (CVSS NVD)8.8High
Exploit odds (30 days)0.8%top 43.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, attackers could craft a request and trick an administrator into importing all new settings. These settings could be modified to include malicious JavaScript, therefore allowing an attacker to inject payloads that could aid in further infection of the site.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ExpressTech | Responsive Menu – Create Mobile-Friendly Menu | 4.0.4 – before 4.0.4 |
| ExpressTech | Responsive Menu Pro | 4.0.4 – before 4.0.4 |
Weakness: CWE-352