95 matches found
CVE-2021-24160 Responsive Menu 4.0.0 - 4.0.3 - Authenticated Arbitrary File Upload
In the Reponsive Menu free and Pro WordPress plugins before 4.0.4, subscribers could upload zip archives containing malicious PHP files that would get extracted to the /rmp-menu/ directory. These files could then be accessed via the front end of the site to trigger remote code execution and...
CVE-2021-24161 Responsive Menu < 4.0.4 - CSRF to Arbitrary File Upload
In the Reponsive Menu free and Pro WordPress plugins before 4.0.4, attackers could craft a request and trick an administrator into uploading a zip archive containing malicious PHP files. The attacker could then access those files to achieve remote code execution and further infect the targeted si...
WordPress 代码问题漏洞
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress Plugin is an open source application plugin for WordPress. A security vulnerability exists in the...
WordPress Responsive Menu plugin <= 4.0.3 - Authenticated Arbitrary File Upload vulnerability
Authenticated Arbitrary File Upload vulnerability found by WordFence in WordPress Responsive Menu plugin versions = 4.0.3. Solution Update the WordPress Responsive Menu plugin to the latest available version at least 4.0.4...
WordPress Responsive Menu plugin <= 4.0.3 - Cross-Site Request Forgery (CSRF) leading to Setting Modification vulnerability
Cross-Site Request Forgery CSRF leading to Setting Modification vulnerability found by WordFence in WordPress Responsive Menu plugin versions = 4.0.3. Solution Update the WordPress Responsive Menu plugin to the latest available version at least 4.0.4...
Responsive Menu 4.0.0 - 4.0.3 - Authenticated Arbitrary File Upload
"A subscriber could upload zip archives containing malicious PHP files that would get extracted to the /rmp-menu/themes/ directory. These files could then be accessed via the front end of the site to trigger remote code execution and ultimately allow an attacker to execute commands to further...
WordPress responsive-men plugin cross-site request forgery vulnerability
WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. responsive-menu is a responsive menu plugin used in it. Cross-site request forgery vulnerability exists in WordPress responsive-me...
WordPress Responsive Menu Plugin < 3.1.4 CSRF Vulnerability
The WordPress plugin Copyright C 2019 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the...
CVE-2017-18513
The responsive-menu plugin before 3.1.4 for WordPress has no CSRF protection mechanism for the admin interface...
Cross site request forgery (csrf)
The responsive-menu plugin before 3.1.4 for WordPress has no CSRF protection mechanism for the admin interface...
CVE-2017-18513
Affected software: WordPress, plugin “responsive-menu” prior to 3.1.4. Root cause: missing CSRF protection in the admin interface. Vulnerability description: CVE-2017-18513 documents a CSRF risk for admin actions in the responsive-menu plugin. Multiple connected sources (Red Hat, CNVD, NVD, PRION...
CVE-2017-18513
The responsive-menu plugin before 3.1.4 for WordPress has no CSRF protection mechanism for the admin interface...
CVE-2017-18513: Cross-Site Request Forgery (CSRF)
The responsive-menu plugin before 3.1.4 for WordPress has no CSRF protection mechanism for the admin interface...
WordPress Responsive Menu plugin <= 3.1.3 - Cross-Site Request Forgery (CSRF) and Cross-Site Scripting (XSS) Vulnerability
Wordpress Responsive Menu plugin Cross-Site Request Forgery CSRF and Cross-Site Scripting XSS Vulnerabilities. There's a lack of sanitization for saving the options in updateOptions function, in the /app/Controllers/AdminController.php file. Also, a nonce is missing in the plugin's settings page...