Threat Entry Updated 2024-07-31

CVE-2024-2508 - Wp Mobile Menu Plugin

The WP Mobile Menu plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_menu_item_icon function in all versions up to, and including, 2.8.4.4. This makes it possible for unauthenticated attackers to add the '_mobmenu_icon' post meta to arbitrary posts with an arbitrary (but sanitized) value. NOTE: Version 2.8.4.4 contains a partial fix for this vulnerability.

PLUGIN Wp Mobile Menu

CVE-2024-2508

MEDIUM CVSS 5.3 2024-07-31

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-21

CVE-2024-3987 - Wp Mobile Menu Plugin

The WP Mobile Menu – The Mobile-Friendly Responsive Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt text in all versions up to, and including, 2.8.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Wp Mobile Menu

CVE-2024-3987

MEDIUM CVSS 5.4 2024-06-07

Risk Score

Open Full Technical Breakdown