CVE-2021-25113

5.4 mediumEPSS 0.6%

Medium (5.4) in dropdown menu widget project dropdown menu widget. EPSS 0.6% chance of exploitation in the next 30 days.

The Dropdown Menu Widget WordPress plugin through 1.9.7 does not have authorisation and CSRF checks when saving its settings, allowing low privilege users such as subscriber to update them. Due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site Scripting issues

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 48% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2022-04-04
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

dropdown_menu_widget_project:dropdown_menu_widget

References

https://wpscan.com/vulnerability/7a5078db-e0d4-4076-9de9-5401c3ca0d65
https://wpscan.com/vulnerability/7a5078db-e0d4-4076-9de9-5401c3ca0d65

Check your stack JSON