CVE-2021-24162: Responsive Menu < 4.0.4 - CSRF to Settings Update

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-04-05 · updated 2026-06-17
Weakness: CWE-352

Description

In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, attackers could craft a request and trick an administrator into importing all new settings. These settings could be modified to include malicious JavaScript, therefore allowing an attacker to inject payloads that could aid in further infection of the site.

Affected products

ExpressTech Responsive Menu (WordPress plugin): before 4.0.4 — fixed in 4.0.4

How to fix

Upgrade to a fixed version: ExpressTech Responsive Menu (WordPress plugin) 4.0.4. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/923fc3a3-4bcc-4b48-870a-6150e14509b5
https://www.wordfence.com/blog/2021/02/multiple-vulnerabilities-patched-in-responsive-menu-plugin/
https://wpscan.com/vulnerability/923fc3a3-4bcc-4b48-870a-6150e14509b5
https://www.wordfence.com/blog/2021/02/multiple-vulnerabilities-patched-in-responsive-menu-plugin/

Get alerted when CVE-2021-24162 or the next vulnerability affects your stack