What’s Vulnerable › Vulnerabilities

CVE-2021-24521: Side Menu Lite < 2.2.1 - Authenticated SQL Injection

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-08-09 · updated 2026-06-17
• Weakness: CWE-89

Description

The Side Menu Lite – add sticky fixed buttons WordPress plugin before 2.2.1 does not properly sanitize input values from the browser when building an SQL statement. Users with the administrator role or permission to manage this plugin could perform an SQL Injection attack.

Affected products

• Side Menu Lite – add sticky fixed buttons: before 2.2.1 — fixed in 2.2.1

How to fix

Upgrade to a fixed version: Side Menu Lite – add sticky fixed buttons 2.2.1. Check the vendor advisory for mitigations.

References

• https://github.com/pang0lin/CVEproject/blob/main/wordpress_side-menu-lite_sqli.md
• https://wpscan.com/vulnerability/eb21ebc5-265c-4378-b2c6-62f6bc2f69cd
• https://github.com/pang0lin/CVEproject/blob/main/wordpress_side-menu-lite_sqli.md
• https://wpscan.com/vulnerability/eb21ebc5-265c-4378-b2c6-62f6bc2f69cd

Get alerted when CVE-2021-24521 or the next vulnerability affects your stack