Social Rocket Social Sharing Plugin
Monthly
Stored Cross-Site Scripting in Social Rocket - Social Sharing Plugin for WordPress up to version 1.3.4.2 allows authenticated Subscriber-level users to inject arbitrary JavaScript via the 'id' parameter, which executes in the browsers of all users viewing affected pages. The vulnerability stems from insufficient input sanitization and output escaping, and exploitation requires only subscriber-level WordPress authentication with no user interaction needed beyond the initial injection.
Stored Cross-Site Scripting in Social Rocket - Social Sharing Plugin for WordPress up to version 1.3.4.2 allows authenticated Subscriber-level users to inject arbitrary JavaScript via the 'id' parameter, which executes in the browsers of all users viewing affected pages. The vulnerability stems from insufficient input sanitization and output escaping, and exploitation requires only subscriber-level WordPress authentication with no user interaction needed beyond the initial injection.