PT-2025-17888 · WordPress · Add Google +1 (Plus One) Social Share Button

Johannes Skamletz + 1 · Published 2025-04-25 · Updated 2025-04-25 · CVE-2025-3866

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Add Google +1 (Plus one) social share Button plugin for WordPress version 1.0.0 and earlier

Description The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the google-plus-one-share-button page. This allows unauthenticated attackers to update settings and inject malicious web scripts via a forged request, provided they can trick a site administrator into performing a specific action, such as clicking on a link.

Recommendations For Add Google +1 (Plus one) social share Button plugin for WordPress version 1.0.0 and earlier, consider disabling the plugin until a patch is available to prevent exploitation. Restrict access to the google-plus-one-share-button page to minimize the risk of settings updates and malicious script injections.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-3866

Affected Products

Add Google +1 (Plus One) Social Share Button

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-3866 · Security Note
• https://twitter.com/VulmonFeeds/status/1915670906107539535 · Twitter Post
• https://t.me/cvenotify/119775 · Telegram Post
• https://twitter.com/CVEnew/status/1915665981050949803 · Twitter Post
• https://wordpress.org/plugins/add-google-plus-one-social-share-button · Note
• https://t.me/cvetracker/22354 · Telegram Post
• https://t.me/cvedetector/23739 · Telegram Post
• https://plugins.trac.wordpress.org/browser/add-google-plus-one-social-share-button/tags/1.0.0/gp_admin_page.php · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/190a3b11-c6ca-4666-8c7f-b22bb4a4961d?source=cve · Note