CVE-2021-34666

The Add Sidebar WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the add parameter in the ~/wp_sidebarMenu.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0.0.

• CWE-79
• CWE-79

• https://plugins.trac.wordpress.org/browser/sidebar-adder/tags/2.0.1/wp_sidebarMenu.php#L124Exploit, Third Party Advisory
• https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34666Exploit, Third Party Advisory
• https://plugins.trac.wordpress.org/browser/sidebar-adder/tags/2.0.1/wp_sidebarMenu.php#L124Exploit, Third Party Advisory
• https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34666Exploit, Third Party Advisory

Published

Aug 16, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-3466A flaw was found in libmicrohttpd. A missing bounds check in…9.8
• CVE-2021-34660The WP Fusion Lite WordPress plugin is vulnerable to Reflect…6.1
• CVE-2021-34661The WP Fusion Lite WordPress plugin is vulnerable to Cross-S…4.7
• CVE-2021-34663The jQuery Tagline Rotator WordPress plugin is vulnerable to…6.1
• CVE-2021-34664The Moova for WooCommerce WordPress plugin is vulnerable to …6.1
• CVE-2021-34665The WP SEO Tags WordPress plugin is vulnerable to Reflected …6.1
• CVE-2021-34667The Calendar_plugin WordPress plugin is vulnerable to Reflec…6.1
• CVE-2021-34668The WordPress Real Media Library WordPress plugin is vulnera…5.4
• CVE-2021-3467A NULL pointer dereference flaw was found in the way Jasper …5.5
• CVE-2021-34675Basix NEX-Forms through 7.8.7 allows authentication bypass f…7.5
• CVE-2021-34676Basix NEX-Forms through 7.8.7 allows authentication bypass f…7.5
• CVE-2021-34679Thycotic Password Reset Server before 5.3.0 allows credentia…7.5