Vulnerability · Published Aug 2, 2021 · Assigned by WPScan
CVE-2021-24425myStickymenu < 2.5.2 - Authenticated Stored XSS
Medium 4.8
In plain English
A medium-severity cross-site scripting in Floating Notification Bar, Sticky Menu on Scroll, and Sticky Header for Any Theme – myStickymenu from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).
Official description
The Floating Notification Bar, Sticky Menu on Scroll, and Sticky Header for Any Theme – myStickymenu WordPress plugin before 2.5.2 does not sanitise or escape its Bar Text settings, allowing hight privilege users to use malicious JavaScript in it, leading to a Stored Cross-Site Scripting issue, which will be triggered in the plugin's setting, as well as all front-page of the blog (when the Welcome bar is active)
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Floating Notification Bar, Sticky Menu on Scroll, and Sticky Header for Any Theme – myStickymenu | 2.5.2 – before 2.5.2 |
Weakness: CWE-79