LiveActive security incident?Get immediate response
CVE Record

CVE-2021-24425: myStickymenu < 2.5.2 - Authenticated Stored XSS

The Floating Notification Bar, Sticky Menu on Scroll, and Sticky Header for Any Theme – myStickymenu WordPress plugin before 2.5.2 does not sanitise or escape its Bar Text settings, allowing hight privilege users to use malicious JavaScript in it, leading to a Stored Cross-Site Scripting issue, which will be triggered in the plugin's setting, as well as all front-page of the blog (when the Welcome bar is active)

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2021-24425 is a stored cross-site scripting issue in the myStickymenu WordPress plugin before 2.5.2. A high-privilege authenticated user could save malicious JavaScript in the Bar Text setting. When the Welcome bar is active, that script can run on plugin settings pages and front pages of the blog.

Executive priority

Treat as a moderate priority for WordPress estates. It is not reported as actively exploited in the provided sources, but stored XSS on public pages can affect visitors and administrators if an attacker obtains privileged access.

Technical view

The issue is CWE-79 improper sanitization or escaping of the Bar Text setting in the myStickymenu plugin. The source bundle describes authenticated stored XSS requiring high privilege. Execution occurs where the setting is rendered, including front pages when the Welcome bar is active. No CVSS vector is provided.

Likely exposure

Exposure is limited to WordPress sites running myStickymenu versions before 2.5.2, especially where the Welcome bar is active and high-privilege accounts can edit plugin settings.

Exploitation context

The provided sources do not show CISA KEV listing or active exploitation. The vulnerability requires authenticated high-privilege access, so risk is highest after admin account compromise or malicious insider activity.

Researcher notes

Evidence is limited to the CVE description and public advisory references. The affected condition is clear: unsanitized Bar Text in myStickymenu before 2.5.2. No CVSS score, exploit-in-the-wild evidence, or detailed vendor remediation text is included in the bundle.

Mitigation direction

  • Inventory WordPress sites for the myStickymenu plugin and installed version.
  • Upgrade off myStickymenu versions before 2.5.2 following vendor guidance.
  • Restrict plugin settings access to trusted administrators only.
  • Disable the Welcome bar until remediation if exposure is unacceptable.
  • Review recent admin changes to Bar Text settings for suspicious content.

Validation and detection

  • Confirm whether myStickymenu is installed on each WordPress site.
  • Verify the installed plugin version is not before 2.5.2.
  • Check whether the Welcome bar is enabled on affected sites.
  • Review Bar Text configuration for unexpected script-like content.
  • Confirm only authorized administrators can change plugin settings.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-79: User-session and phishing behavior lookup

Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2021-24425 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
UnknownFloating Notification Bar, Sticky Menu on Scroll, and Sticky Header for Any Theme – myStickymenu2.5.2Listed
Weakness

CWE details

CWE-79

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-79 · source CWE mapping

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs