The WP Responsive Menu WordPress plugin before 3.1.7.1 does not have capability and CSRF checks in the wpr_live_update AJAX action, as well as do not sanitise and escape some of the data submitted.
CVSS 3.1MEDIUM 5.4·Network·Low privileges·User interaction·EPSS 0.006·Published 2022-02-28·Fixed in 3.1.7.1CWE-79