VulnerabilityModified
CVE-2021-24521
Users with the administrator role or permission to manage this plugin could perform an SQL Injection attack.
HIGH 7.2EPSS 1.59%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.59%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The Side Menu Lite – add sticky fixed buttons WordPress plugin before 2.2.1 does not properly sanitize input values from the browser when building an SQL statement. Users with the administrator role or permission to manage this plugin could perform an SQL Injection attack.
- CVSS 3.1
- 7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.59% probability · 74th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-89
- Affected
- wow-estore/side menu
- Source
- contact@wpscan.com
References
- https://github.com/pang0lin/CVEproject/blob/main/wordpress_side-menu-lite_sqli.mdExploit, Third Party Advisory
- https://wpscan.com/vulnerability/eb21ebc5-265c-4378-b2c6-62f6bc2f69cdExploit, Third Party Advisory
- https://github.com/pang0lin/CVEproject/blob/main/wordpress_side-menu-lite_sqli.mdExploit, Third Party Advisory
- https://wpscan.com/vulnerability/eb21ebc5-265c-4378-b2c6-62f6bc2f69cdExploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.