EUVD-2026-93055
GHSA-842r-42wq-mc89
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious XSS payload URL
-
DeliveryLure WordPress user to click link
-
ExploitUnsanitized input reflected in page
-
ExecutionScript executes in victim browser
-
ImpactHijack session or forge admin actions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires victim user interaction (UI:R) - a WordPress user or administrator must be enticed to click a crafted link or view attacker-influenced content served through the Social Rocket plugin (version 1.3.5 or earlier). No authentication is required of the attacker (PR:N), but the payload only executes within the victim's authenticated browser session, so impact is bounded by the privileges and session of whoever is social-engineered. The WordPress site must be running a vulnerable Social Rocket build; sites not using this plugin or already updated past 1.3.5 are unaffected. The description does not specify whether the sink is reflected or stored, which affects how the lure is delivered. |
| Impact | This is a moderate-severity reflected/stored Cross-Site Scripting flaw (CWE-79) in the Social Rocket WordPress plugin, rated CVSS 7.1 with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The network vector, low complexity, and PR:N (unauthenticated) are the aggravating signals, but UI:R materially lowers real-world risk: a victim - typically a logged-in administrator or user - must be induced to interact with attacker-controlled input (visit a crafted link or view a poisoned page) for the payload to fire. The scope change (S:C) reflects script executing in the victim's browser context rather than the server, which is why confidentiality/integrity impacts are only Low and why availability impact (A:L) is debatable for an XSS. No EPSS score, CISA KEV entry, or public POC was provided in the input, so there is no public exploit identified at time of analysis; this sits well below KEV-listed or mass-exploited bugs in priority. Treat as a standard patch-cycle item: real but dependent on social-engineering and not evidence of active, widespread exploitation. |
| Exploit ScenarioDerived | An attacker crafts a malicious link or input containing a JavaScript payload targeting a vulnerable Social Rocket endpoint and lures a WordPress user or administrator into triggering it. When the victim's browser renders the unsanitized output, the script executes in their session context, enabling session/cookie theft, admin-action forgery, or redirection. No public proof-of-concept was referenced in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Cross-site scripting (CWE-79) in the Social Rocket WordPress plugin through version 1.3.5 lets an unauthenticated attacker deliver a script payload that executes in a victim's browser session once that victim is enticed to click a crafted link or view attacker-influenced content rendered through the plugin (CVSS 7.1, AV:N/AC:L/PR:N/UI:R/S:C, scope changed). No credentials are required to construct or deliver the payload, but the script only runs with the privileges of the social-engineered user, so real-world impact is bounded by the role and session of whoever is tricked. This is not a CISA KEV entry and no public exploit code has been identified at time of analysis; the disclosure is medium/moderate risk and the underlying advisory does not clarify whether the injection point is reflected or stored, which determines how the lure must be delivered.
RemediationAI
No vendor-released patch version is identified in the available data, so the immediate action is to check the Social Rocket plugin's WordPress.org page and the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/social-rocket/vulnerability/wordpress-social-rocket-plugin-1-3-5-cross-site-scripting-xss-vulnerability?_s_id=cve) for the newest release and upgrade past 1.3.5 as soon as one is available. If the plugin's social-sharing features are not business-critical, deactivating and removing it eliminates the attack surface outright, at the cost of losing that front-end functionality; if it must stay, deploy a WAF or virtual-patching rule that blocks script-bearing payloads targeting the plugin's endpoints, accepting that generic XSS signatures produce false positives and can be evaded by encoding tricks. Restrict administrative and editor accounts to trusted users, enforce least privilege, and avoid granting unfiltered_html to lower roles to reduce the damage if an admin session is lured, and consider a Content-Security-Policy that disallows inline script - noting that strict CSP frequently breaks unrelated theme and plugin scripts and must be tested in report-only mode first. Continuous monitoring, prompt WordPress plugin inventory review, and phishing-resistant user awareness remain the compensating controls until an official fix is confirmed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Social Rocket is a WordPress plugin that adds social sharing and social-growth functionality to a site's posts and pages. The flaw is a classic CWE-79 improper-neutralization-of-input-during-web-page-generation problem: attacker-supplied input is echoed back into an HTML response without adequate output encoding or sanitization, so a browser parses embedded markup as script in the context of the WordPress site. The affected package is identified by CPE cpe:2.3:a:socialrocket:social_rocket:*:*:*:*:*:*:*:* (any version up to and including 1.3.5), confirming the CPE vendor/product pairing maps to the social-rocket plugin distributed through the WordPress.org ecosystem. The vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L describes a network-reachable, low-complexity issue requiring no attacker authentication but requiring victim interaction; the scope-changed (S:C) component reflects that code executes in the security context of the vulnerable WordPress site and can therefore affect resources beyond the vulnerable plugin component itself. Because the payload runs in the victim's authenticated browser session, a successfully lured administrator could yield far greater follow-on capability (for example scripted actions performed with admin cookies) than a lured low-privileged subscriber. The single public reference is Patchstack's vulnerability record for the plugin, and no patch or fixed-version detail is provided in the available data.
Know when Social Rocket gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Unauthenticated network XSS requiring victim interaction (PR:N/UI:R), scope change to browser context (S:C), low C/I; availability set to N as XSS does not meaningfully degrade availability.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in Social Rocket <= 1.3.5 versions.
Executive ViewAI
Social Rocket, a WordPress social-sharing plugin installed on our public-facing sites at version 1.3.5 and earlier, contains a cross-site scripting flaw that lets an unauthenticated attacker run script in the browser of any employee or customer enticed into clicking a crafted link. Because the plugin has no vendor-released patch and sits on internet-facing sites, every instance running it remains exposed and a successful attack could lead to session theft, credential harvesting, or content tampering under the victim's own access rights. Leadership should treat this as a medium-priority remediation item rather than an emergency: no public exploit code has been identified at time of analysis and exploitation requires the victim to be socially engineered.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate or remove the Social Rocket plugin (version 1.3.5 and earlier) where it is not business-critical; apply WAF/edge filtering for cross-site scripting patterns on plugin endpoints; enforce Content-Security-Policy on WordPress front ends; set HttpOnly and SameSite flags on session cookies; restrict access to pages rendered through the plugin; and monitor vendor channels for a fixed release above 1.3.5.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Social Rocket
View allThe Social Rocket WordPress plugin before 1.3.3 does not sanitise and escape some of its settings, which could allow hig
The Social Rocket - Social Sharing Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plug
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Social Rock
The Social Rocket - Social Sharing Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to
Exploit-DB