Read the docs
TI-2021-07034 Aliases CVE-2021-24752GHSA-qcgq-c97q-26vw

Multiple Plugins from CatchThemes - Unauthorised Plugin's Setting Change

Priority LOW 26CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Security bypass, Tampering
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-284 and CWE-352.

Summary

Multiple Plugins from the CatchThemes vendor do not perform capability and CSRF checks in the ctp_switch AJAX action, which could allow any authenticated users, such as Subscriber to change the Essential Widgets WordPress plugin before 1.9, To Top WordPress plugin before 2.3, Header Enhancement WordPress plugin before 1.5, Generate Child Theme WordPress plugin before 1.6, Essential Content Types WordPress plugin before 1.9, Catch Web Tools WordPress plugin before 2.7, Catch Under Construction WordPress plugin before 1.4, Catch Themes Demo Import WordPress plugin before 1.6, Catch Sticky Menu WordPress plugin before 1.7, Catch Scroll Progress Bar WordPress plugin before 1.6, Social Gallery and Widget WordPress plugin before 2.3, Catch Infinite Scroll WordPress plugin before 1.9, Catch Import Export WordPress plugin before 1.9, Catch Gallery WordPress plugin before 1.7, Catch Duplicate Switcher WordPress plugin before 1.6, Catch Breadcrumb WordPress plugin before 1.7, Catch IDs WordPress plugin before 2.4's configurations.

Why it matters now

EPSS 0.00422 36th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Essential Widgets (CatchThemes): 1.9To Top (CatchThemes): 2.3+15 more products

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
catchthemesEssential Widgets1.9 to before 1.91.9Patch availableCNA
catchthemesTo Top2.3 to before 2.32.3Patch availableCNA
catchthemesHeader Enhancement1.5 to before 1.51.5Patch availableCNA
catchthemesGenerate Child Theme1.6 to before 1.61.6Patch availableCNA
catchthemesEssential Content Types1.9 to before 1.91.9Patch availableCNA
catchthemesCatch Web Tools2.7 to before 2.72.7Patch availableCNA
catchthemesCatch Under Construction1.4 to before 1.41.4Patch availableCNA
catchthemesCatch Themes Demo Import1.6 to before 1.61.6Patch availableCNA
catchthemesCatch Sticky Menu1.7 to before 1.71.7Patch availableCNA
catchthemesCatch Scroll Progress Bar1.6 to before 1.61.6Patch availableCNA
catchthemesSocial Gallery and Widget2.3 to before 2.32.3Patch availableCNA
catchthemesCatch Infinite Scroll1.9 to before 1.91.9Patch availableCNA
catchthemesCatch Import Export1.9 to before 1.91.9Patch availableCNA
catchthemesCatch Gallery1.7 to before 1.71.7Patch availableCNA
catchthemesCatch Duplicate Switcher1.6 to before 1.61.6Patch availableCNA
catchthemesCatch Breadcrumb1.7 to before 1.71.7Patch availableCNA
catchthemesCatch IDs2.4 to before 2.42.4Patch availableCNA
  • Essential Widgets Vendorcatchthemes Affected 1.9 to before 1.9 Fixed in 1.9 Patch available CNA
  • To Top Vendorcatchthemes Affected 2.3 to before 2.3 Fixed in 2.3 Patch available CNA
  • Header Enhancement Vendorcatchthemes Affected 1.5 to before 1.5 Fixed in 1.5 Patch available CNA
  • Generate Child Theme Vendorcatchthemes Affected 1.6 to before 1.6 Fixed in 1.6 Patch available CNA
  • Essential Content Types Vendorcatchthemes Affected 1.9 to before 1.9 Fixed in 1.9 Patch available CNA
  • Catch Web Tools Vendorcatchthemes Affected 2.7 to before 2.7 Fixed in 2.7 Patch available CNA
  • Catch Under Construction Vendorcatchthemes Affected 1.4 to before 1.4 Fixed in 1.4 Patch available CNA
  • Catch Themes Demo Import Vendorcatchthemes Affected 1.6 to before 1.6 Fixed in 1.6 Patch available CNA
  • Catch Sticky Menu Vendorcatchthemes Affected 1.7 to before 1.7 Fixed in 1.7 Patch available CNA
  • Catch Scroll Progress Bar Vendorcatchthemes Affected 1.6 to before 1.6 Fixed in 1.6 Patch available CNA
  • Social Gallery and Widget Vendorcatchthemes Affected 2.3 to before 2.3 Fixed in 2.3 Patch available CNA
  • Catch Infinite Scroll Vendorcatchthemes Affected 1.9 to before 1.9 Fixed in 1.9 Patch available CNA
  • Catch Import Export Vendorcatchthemes Affected 1.9 to before 1.9 Fixed in 1.9 Patch available CNA
  • Catch Gallery Vendorcatchthemes Affected 1.7 to before 1.7 Fixed in 1.7 Patch available CNA
  • Catch Duplicate Switcher Vendorcatchthemes Affected 1.6 to before 1.6 Fixed in 1.6 Patch available CNA
  • Catch Breadcrumb Vendorcatchthemes Affected 1.7 to before 1.7 Fixed in 1.7 Patch available CNA
  • Catch IDs Vendorcatchthemes Affected 2.4 to before 2.4 Fixed in 2.4 Patch available CNA

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:a:catchplugins:catch_scroll_progress_bar:*:*:*:*:*:wordpress:*:*before 1.6VulnerableCatch Plugins
cpe:2.3:a:catchplugins:catch_sticky_menu:*:*:*:*:*:wordpress:*:*before 1.7VulnerableCatch Plugins
cpe:2.3:a:catchplugins:catch_themes_demo_import:*:*:*:*:*:wordpress:*:*before 1.6VulnerableCatch Plugins
cpe:2.3:a:catchplugins:catch_under_construction:*:*:*:*:*:wordpress:*:*before 1.4VulnerableCatch Plugins
cpe:2.3:a:catchplugins:catch_web_tools:*:*:*:*:*:wordpress:*:*before 2.7VulnerableCatch Plugins
cpe:2.3:a:catchplugins:essential_content_types:*:*:*:*:*:wordpress:*:*before 1.9VulnerableCatch Plugins
cpe:2.3:a:catchplugins:essential_widgets:*:*:*:*:*:wordpress:*:*before 1.9VulnerableCatch Plugins
cpe:2.3:a:catchplugins:generate_child_theme:*:*:*:*:*:wordpress:*:*before 1.6VulnerableCatch Plugins
cpe:2.3:a:catchplugins:header_enhancement:*:*:*:*:*:wordpress:*:*before 1.5VulnerableCatch Plugins
cpe:2.3:a:catchplugins:to_top:*:*:*:*:*:wordpress:*:*before 2.3VulnerableCatch Plugins
  • cpe:2.3:a:catchplugins:catch_scroll_progress_bar:*:*:*:*:*:wordpress:*:* Versions before 1.6 Vulnerable ·Catch Plugins
  • cpe:2.3:a:catchplugins:catch_sticky_menu:*:*:*:*:*:wordpress:*:* Versions before 1.7 Vulnerable ·Catch Plugins
  • cpe:2.3:a:catchplugins:catch_themes_demo_import:*:*:*:*:*:wordpress:*:* Versions before 1.6 Vulnerable ·Catch Plugins
  • cpe:2.3:a:catchplugins:catch_under_construction:*:*:*:*:*:wordpress:*:* Versions before 1.4 Vulnerable ·Catch Plugins
  • cpe:2.3:a:catchplugins:catch_web_tools:*:*:*:*:*:wordpress:*:* Versions before 2.7 Vulnerable ·Catch Plugins
  • cpe:2.3:a:catchplugins:essential_content_types:*:*:*:*:*:wordpress:*:* Versions before 1.9 Vulnerable ·Catch Plugins
  • cpe:2.3:a:catchplugins:essential_widgets:*:*:*:*:*:wordpress:*:* Versions before 1.9 Vulnerable ·Catch Plugins
  • cpe:2.3:a:catchplugins:generate_child_theme:*:*:*:*:*:wordpress:*:* Versions before 1.6 Vulnerable ·Catch Plugins
  • cpe:2.3:a:catchplugins:header_enhancement:*:*:*:*:*:wordpress:*:* Versions before 1.5 Vulnerable ·Catch Plugins
  • cpe:2.3:a:catchplugins:to_top:*:*:*:*:*:wordpress:*:* Versions before 2.3 Vulnerable ·Catch Plugins

Remediation

  • Fix · CNA Essential Widgets (CatchThemes) Fixed in 1.9
  • Fix · CNA To Top (CatchThemes) Fixed in 2.3
  • Fix · CNA Header Enhancement (CatchThemes) Fixed in 1.5
  • Fix · CNA Generate Child Theme (CatchThemes) Fixed in 1.6
  • Fix · CNA Essential Content Types (CatchThemes) Fixed in 1.9
  • Fix · CNA Catch Web Tools (CatchThemes) Fixed in 2.7
  • Fix · CNA Catch Under Construction (CatchThemes) Fixed in 1.4
  • Fix · CNA Catch Themes Demo Import (CatchThemes) Fixed in 1.6
  • Fix · CNA Catch Sticky Menu (CatchThemes) Fixed in 1.7
  • Fix · CNA Catch Scroll Progress Bar (CatchThemes) Fixed in 1.6
  • Fix · CNA Social Gallery and Widget (CatchThemes) Fixed in 2.3
  • Fix · CNA Catch Infinite Scroll (CatchThemes) Fixed in 1.9
  • Fix · CNA Catch Import Export (CatchThemes) Fixed in 1.9
  • Fix · CNA Catch Gallery (CatchThemes) Fixed in 1.7
  • Fix · CNA Catch Duplicate Switcher (CatchThemes) Fixed in 1.6
  • Fix · CNA Catch Breadcrumb (CatchThemes) Fixed in 1.7
  • Fix · CNA Catch IDs (CatchThemes) Fixed in 2.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-24752
  2. 2026-10-03 Alias added: GHSA-qcgq-c97q-26vw

References

Exploit 1

  • TI-2025-23252 WordPress Catch Dark Mode plugin <= 2.0.1 - Local File Inclusion vulnerability CVSS 3.1HIGH 8.8
  • TI-2025-09315 Catch Dark Mode <= 2.0 - Authenticated (Contributor+) Local File Inclusion CVSS 3.1HIGH 7.5
  • TI-2025-17386 WordPress Catch Duplicate Switcher plugin <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerability CVSS 3.1HIGH 7.1
  • TI-2023-11206 WordPress Darcie Theme <= 1.1.5 is vulnerable to Cross Site Scripting (XSS) CVSS 3.1HIGH 7.1
  • TI-2026-00647 Essential Widgets <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes CVSS 3.1MEDIUM 6.4
  • TI-2025-41297 WordPress Essential Widgets plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability CVSS 3.1MEDIUM 6.5
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences