EUVD-2026-42168
GHSA-4f3m-h538-6f53
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-delivered reflected XSS requires no privileges (PR:N) but mandatory victim click (UI:R); scope changes to victim's browser (S:C) with limited confidentiality and integrity impact; no availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Social Share, Social Login and Social Comments Plugin - Super Socializer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'heateor_mastodon_share' parameter in all versions up to, and including, 7.14.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
AnalysisAI
Reflected Cross-Site Scripting in the Super Socializer WordPress plugin (versions up to and including 7.14.5) enables unauthenticated remote attackers to inject arbitrary JavaScript via the unsanitized 'heateor_mastodon_share' parameter, discovered and reported by Wordfence with source-level confirmation at helper.php lines 1243-1246. Successful exploitation requires social engineering a victim into clicking a crafted URL, after which the payload executes within the victim's browser session in the context of the target WordPress site. No public exploit code or active exploitation has been identified at time of analysis; the CVSS 6.1 (Medium) rating reflects the mandatory user-interaction requirement that constrains opportunistic mass exploitation.
Technical ContextAI
The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic reflected XSS class where user-supplied data is echoed back into HTML output without adequate sanitization or output encoding. The affected code is confirmed at helper.php lines 1243 and 1246 in plugin version 7.14.5 (visible via the WordPress Trac browser references). The affected product is identified by CPE cpe:2.3:a:the_champ:social_share,_social_login_and_social_comments_plugin_-_super_socializer:*:*:*:*:*:*:*:* - a feature-rich WordPress plugin by The Champ that bundles social sharing (including Mastodon), social login via OAuth providers, and social commenting. The vulnerable parameter 'heateor_mastodon_share' is processed during Mastodon share flow handling; insufficient server-side input validation allows malicious script content to survive into the HTTP response and be parsed by the victim's browser. The CVSS Scope:Changed metric confirms that while the vulnerability resides on the WordPress server, the impact crosses into the victim's browser security context.
RemediationAI
Patch available per vendor advisory - update the Super Socializer plugin to a version beyond 7.14.5 as soon as a patched release is published; the exact fix version is not confirmed in available data, so monitor the WordPress plugin repository and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/37d9171d-4722-4ebc-a773-9fd497bc12cf for release confirmation. If an immediate update is not possible, a compensating control is to disable the Mastodon share feature within the plugin's settings, which removes the vulnerable code path; trade-off is loss of Mastodon sharing functionality for site visitors. Alternatively, deploying a Web Application Firewall (WAF) rule - such as those provided by Wordfence Premium - to block requests containing script content in the 'heateor_mastodon_share' parameter can reduce exploitation risk without functional impact; trade-off is potential false positives on legitimate parameter values containing angle brackets or special characters. In all cases, applying the vendor patch remains the definitive remediation.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today