CVE-2021-24162CWE-352

CVE-2021-24162: vulnerability in ExpressTech Responsive Menu – Create…

Responsive Menu < 4.0.4 - CSRF to Settings Update

Published · Updated

Follow this CVE+ Monitor Responsive Menu – Create Mobile-Friendly Menu+ Monitor Responsive Menu Pro

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 0.8%
In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, attackers could craft a request and trick an administrator into importing all new settings. These settings could be modified to include malicious JavaScript, therefore allowing an attacker to inject payloads that could aid in further infection of the site.
Affected products
ExpressTech · Responsive Menu – Create Mobile-Friendly MenuExpressTech · Responsive Menu Pro
Related CVEs — ExpressTech Responsive Menu – Create…

In the same product, most dangerous first.

CVE-2021-24160—Responsive Menu 4.0.0 - 4.0.3 - Authenticated Arbitrary File UploadEPSS 8.2%CVE-2021-24161—Responsive Menu < 4.0.4 - CSRF to Arbitrary File UploadEPSS 1.2%