CVE-2021-24162

In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, attackers could craft a request and trick an administrator into importing all new settings. These settings could be modified to include malicious JavaScript, therefore allowing an attacker to inject payloads that could aid in further infection of the site.

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v2.0

6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS

0.80% chance of exploitation in the next 30 days, 54th percentile

Published

2021-04-05

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/923fc3a3-4bcc-4b48-870a-6150e14509b5

References

• CVE Record
• NVD entry

Related

• CVE-2021-24160
• CVE-2021-24163
• CVE-2021-24158
• CVE-2021-24164
• CVE-2021-24157
• CVE-2021-24165