Social Share Buttons & Analytics Plugin < 4.4 - Admin+ Stored XSS

2023-12-0800:00:00

wpscan.com

plugin

stored xss

admin

settings

cross-site scripting

multisite

AI Score

5.3

Confidence

High

EPSS

Percentile

14.0%

JSON

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

References

patchstack.com/database/vulnerability/wp-share-buttons-analytics-by-getsocial/wordpress-social-share-buttons-analytics-plugin-getsocial-io-plugin-4-3-12-cross-site-scripting-xss-vulnerability