CVE-2021-24161: Expresstech Responsive Menu

High severity, CVSS 8.8. EPSS: 1.2% chance of exploitation in the next 30 days.

In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, attackers could craft a request and trick an administrator into uploading a zip archive containing malicious PHP files. The attacker could then access those files to achieve remote code execution and further infect the targeted site.

Affected products

• Expresstech Responsive Menu: before 4.0.4 (fixed in 4.0.4)

Published 2021-04-05. Last modified 2026-06-17.