Read the docs
TI-2021-06454 Aliases CVE-2021-24162GHSA-mp4f-p2f3-644f

Responsive Menu < 4.0.4 - CSRF to Settings Update

Priority LOW 39CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-352.

Summary

In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, attackers could craft a request and trick an administrator into importing all new settings. These settings could be modified to include malicious JavaScript, therefore allowing an attacker to inject payloads that could aid in further infection of the site.

Why it matters now

EPSS 0.00796 56th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed Responsive Menu – Create Mobile-Friendly Menu (ExpressTech): 4.0.4Responsive Menu Pro (ExpressTech): 4.0.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ExpressTechResponsive Menu – Create Mobile-Friendly Menu4.0.4 to before 4.0.44.0.4Patch availableCNA
ExpressTechResponsive Menu Pro4.0.4 to before 4.0.44.0.4Patch availableCNA
  • Responsive Menu – Create Mobile-Friendly Menu VendorExpressTech Affected 4.0.4 to before 4.0.4 Fixed in 4.0.4 Patch available CNA
  • Responsive Menu Pro VendorExpressTech Affected 4.0.4 to before 4.0.4 Fixed in 4.0.4 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:expresstech:responsive_menu:*:*:*:*:free:wordpress:*:*before 4.0.4VulnerableExpressTech
cpe:2.3:a:expresstech:responsive_menu:*:*:*:*:pro:wordpress:*:*before 4.0.4VulnerableExpressTech
  • cpe:2.3:a:expresstech:responsive_menu:*:*:*:*:free:wordpress:*:* Versions before 4.0.4 Vulnerable ·ExpressTech
  • cpe:2.3:a:expresstech:responsive_menu:*:*:*:*:pro:wordpress:*:* Versions before 4.0.4 Vulnerable ·ExpressTech

Remediation

  • Fix · CNA Responsive Menu – Create Mobile-Friendly Menu (ExpressTech) Fixed in 4.0.4
  • Fix · CNA Responsive Menu Pro (ExpressTech) Fixed in 4.0.4

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    ExpressTech Responsive Menu Pro, Responsive Menu – Create Mobile-Friendly Menu 4.0.4

    3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2021-06452 Responsive Menu 4.0.0 - 4.0.3 - Authenticated Arbitrary File UploadPriority MEDIUM 49
    • TI-2021-06453 Responsive Menu < 4.0.4 - CSRF to Arbitrary File UploadPriority MEDIUM 41
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-24162
  2. 2026-10-03 Alias added: GHSA-mp4f-p2f3-644f

References

Exploit 2

  • TI-2021-06452 Responsive Menu 4.0.0 - 4.0.3 - Authenticated Arbitrary File Upload CVSS 3.1HIGH 8.8
  • TI-2022-09192 Information disclosure in ExpressTech Responsive Menu CVSS 3.1HIGH 8.8
  • TI-2021-06453 Responsive Menu < 4.0.4 - CSRF to Arbitrary File Upload CVSS 3.1HIGH 8.8
  • TI-2017-13686 The responsive-menu plugin before 3.1.4 for WordPress has no CSRF protection mechanism for the admin interface. CVSS 3.0HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences