CVE-2024-2405

MediumCVSS 4.5/10Last modified Jun 17, 2026

Description

The Float menu WordPress plugin before 6.0.1 does not have CSRF check in its bulk actions, which could allow attackers to make logged in admin delete arbitrary menu via a CSRF attack.

Metrics

CVSS 3.1 4.5/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Unknown	Float menu	< 6.0.1
wow-company	float_menu	< 6.0.1

References

https://wpscan.com/vulnerability/c42ffa15-6ebe-4c70-9e51-b95bd05ea04d/Exploit, Third Party Advisory
https://wpscan.com/vulnerability/c42ffa15-6ebe-4c70-9e51-b95bd05ea04d/Exploit, Third Party Advisory

Timeline

Published: May 2, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-240504.7Cross Site Scripting (XSS) vulnerability in Sourcecodester Workout Journal App 1.0 allows attackers to run arbitrary code via parameters fir CVE-2024-240515.5Improper input validation of printing files in Monoprice Select Mini V2 V37.115.32 allows attackers to instruct the device's movable parts t CVE-2024-240595.4springboot-manager v1.6 is vulnerable to Arbitrary File Upload. The system does not filter the suffixes of uploaded files.CVE-2024-24069.8A vulnerability, which was classified as critical, was found in Gacjie Server up to 1.0. This affects the function index of the file /app/ad CVE-2024-240605.4springboot-manager v1.6 is vulnerable to Cross Site Scripting (XSS) via /sys/user.CVE-2024-240615.4springboot-manager v1.6 is vulnerable to Cross Site Scripting (XSS) via /sysContent/add.CVE-2024-240625.4springboot-manager v1.6 is vulnerable to Cross Site Scripting (XSS) via /sys/role.CVE-2024-24085.9The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Ma CVE-2024-24099.8The MasterStudy LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.3.1. This is due to i CVE-2024-240919.8Yealink Meeting Server before v26.0.0.66 was discovered to contain an OS command injection vulnerability via the file upload interface.CVE-2024-240927.8SQL Injection vulnerability in Code-projects.org Scholars Tracking System 1.0 allows attackers to run arbitrary code via login.php.CVE-2024-240939.8SQL Injection vulnerability in Code-projects Scholars Tracking System 1.0 allows attackers to run arbitrary code via Personal Information Up