← CVE Intelligence

CVE-2021-25113

Dropdown Menu Widget <= 1.9.7 - Subscriber+ Arbitrary Settings Update to Stored XSS PUBLISHED

Description (CNA)

The Dropdown Menu Widget WordPress plugin through 1.9.7 does not have authorisation and CSRF checks when saving its settings, allowing low privilege users such as subscriber to update them. Due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site Scripting issues

Affected (CNA)

Vendor / productVersions
Unknown / Dropdown Menu Widgetaffected 1.9.7 through 1.9.7

CWE

CWE-79

References

ADP enrichment

CVE

No English description supplied.