Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

5 records

Vendor: ExpressTech Component: Responsive Menu Clear all filters
TI-2022-09192 CVE-2022-25602 · GHSA-g6mw-6vmq-3w32

Information disclosure in ExpressTech Responsive Menu

Priority MEDIUM 43

Nonce token leak vulnerability leading to arbitrary file upload, theme deletion, plugin settings change discovered in Responsive Menu WordPress plugin (versions <= 4.1.7).

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01313 Published 2022-03-18 No fix listed CWE-200
TI-2021-06454 CVE-2021-24162 · GHSA-mp4f-p2f3-644f

Responsive Menu < 4.0.4 - CSRF to Settings Update

Priority LOW 39

In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, attackers could craft a request and trick an administrator into importing all new settings.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00796 Published 2021-04-05 Fixed in 4.0.4 CWE-352
TI-2021-06453 CVE-2021-24161 · GHSA-2jmf-ff5x-92qw

Responsive Menu < 4.0.4 - CSRF to Arbitrary File Upload

Priority MEDIUM 41

In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, attackers could craft a request and trick an administrator into uploading a zip archive containing malicious PHP files.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01249 Published 2021-04-05 Fixed in 4.0.4 CWE-352
TI-2021-06452 CVE-2021-24160 · GHSA-fjhj-x5j3-wcrf

Responsive Menu 4.0.0 - 4.0.3 - Authenticated Arbitrary File Upload

Priority MEDIUM 49

In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, subscribers could upload zip archives containing malicious PHP files that would get extracted to the /rmp-menu/ directory.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.08196 Published 2021-04-05 Fixed in 4.0.4 CWE-434