Bob Matyas
·
Published
2025-01-28
·
Updated
2025-05-11
·
CVE-2024-12807
4.8
Medium
| Base vector | Vector | AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions:
Social Share Buttons for WordPress versions 2.7 and earlier
Description:
The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example, in a multisite setup. This is due to the plugin not sanitizing and escaping some of its settings.
Recommendations:
Social Share Buttons for WordPress versions 2.7 and earlier: Update the plugin to a version that sanitizes and escapes its settings to prevent Stored Cross-Site Scripting attacks.
Exploit
Fix
XSS