Responsive Menu < 4.0.4 - CSRF to Settings Update

published 2021-04-05 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-11076

cvss: 8.8; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.8%; EPSS 0.8% chance of exploitation in 30 days, percentile 56%
public exploits: 0; none known

In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, attackers could craft a request and trick an administrator into importing all new settings. These settings could be modified to include malicious JavaScript, therefore allowing an attacker to inject payloads that could aid in further infection of the site.

Patch / fix

fixed in 1

expresstech responsive_menu 4.0.4

Exploit prediction

0.80% chance of exploitation in the next 30 days, higher than 56% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

wordfence.com https://www.wordfence.com/blog/2021/02/multiple-vulnerabilities-patched-in-responsive-menu-plugin/ referenced PoC, tagged "exploit" by a source, unverified
wpscan.com https://wpscan.com/vulnerability/923fc3a3-4bcc-4b48-870a-6150e14509b5 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD	2.0	6.8	AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected products

ExpressTech Responsive Menu – Create Mobile-Friendly Menu
ExpressTech Responsive Menu Pro

Classification

Weakness

CWE-352 Cross-Site Request Forgery

Technology feeds

WordPress rss critical rss

References

wordfence.com /blog/2021/02/multiple-vulnerabilities-patched-in-responsive-menu-plugin/
exploit, third-party-advisory
wpscan.com /vulnerability/923fc3a3-4bcc-4b48-870a-6150e14509b5
exploit, third-party-advisory

Sources

CVE List CVE-2021-24162
NVD CVE-2021-24162

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary