CVE-2021-25113

The Dropdown Menu Widget WordPress plugin through 1.9.7 does not have authorisation and CSRF checks when saving its settings, allowing low privilege users such as subscriber to update them. Due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site Scripting issues...

CVE-2021-25113

The CVE-2021-25113 entry concerns the WordPress plugin “Dropdown Menu Widget” (versions up to 1.9.7). The vulnerability arises from missing authorization/CSRF checks when saving settings, enabling low-privilege users (e.g., subscribers) to update settings. The issue is compounded by lack of sanit...