Side Menu Lite < 2.2.1 - Authenticated SQL Injection
Priority LOW 35CWE-89Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-89.
Summary
The Side Menu Lite – add sticky fixed buttons WordPress plugin before 2.2.1 does not properly sanitize input values from the browser when building an SQL statement. Users with the administrator role or permission to manage this plugin could perform an SQL Injection attack.
Why it matters now
EPSS 0.01587 75th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed Side Menu Lite – add sticky fixed buttons (Unknown): 2.2.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Side Menu Lite – add sticky fixed buttons | 2.2.1 to before 2.2.1 | 2.2.1 | Patch available | CNA |
- Side Menu Lite – add sticky fixed buttons VendorUnknown Affected 2.2.1 to before 2.2.1 Fixed in 2.2.1 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:wow-estore:side_menu:*:*:*:*:lite:wordpress:*:* | before 2.2.1 | Vulnerable | Wow-estore |
- cpe:2.3:a:wow-estore:side_menu:*:*:*:*:lite:wordpress:*:* Versions before 2.2.1 Vulnerable ·Wow-estore
Remediation
- Fix · CNA Side Menu Lite – add sticky fixed buttons (Unknown) Fixed in 2.2.1
Timeline
- 2026-10-02 Threatist record created from CVE-2021-24521
- 2026-10-03 Alias added: GHSA-39jf-84mp-m232
References
More Wow-estore Side Menu vulnerabilities
- TI-2021-06864 Side Menu Lite < 2.2.6 - Authenticated SQL Injection CVSS 3.1HIGH 8.8
- TI-2021-06640 Side Menu < 3.1.5 - Authenticated (admin+) SQL Injection CVSS 3.1HIGH 7.2
Sources
- CVE-2021-24521 · CVE Program
- CVE-2021-24521 · NVD
- FIRST EPSS
- GHSA-39jf-84mp-m232 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences