quadlayers QuadMenu – Mega Menu vulnerabilities

Latest quadlayers QuadMenu – Mega Menu CVEs

Newest publication first

1. CVE-2025-2871 WordPress Mega Menu – QuadMenu <= 3.2.0 - Cross-Site Request Forgery to Limited User Meta Update

   Published 2025-04-12

   Medium·CVSS 4.3 EPSS 0.20%

   The WordPress Mega Menu – QuadMenu plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.0. This is due to missing or incorrect nonce validation on the ajax_dismiss_notice() function. This makes it possible for unauthenticated...

2. CVE-2021-4443 WordPress Mega Menu <= 2.0.6 - Arbitrary File Creation

   Published 2024-10-16

   Critical·CVSS 9.8 EPSS 0.67%

   The WordPress Mega Menu plugin for WordPress is vulnerable to Arbitrary File Creation in versions up to, and including, 2.0.6 via the compiler_save AJAX action. This makes it possible for unauthenticated attackers to create arbitrary PHP files that can be used to execute maliciou...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.