Social Share Buttons Analytics Plugin Getsocial Io
Monthly
Stored cross-site scripting in the Social Share Buttons & Analytics plugin - GetSocial.io for WordPress (all versions up to and including 4.5) lets an authenticated attacker with at least subscriber-level access save arbitrary JavaScript through the 'response' parameter into the gs-alert-msg, gs-alert-utm and gs-alert-cta options, which then executes in an administrator's browser when the GetSocial settings page is opened. Exploitation is constrained: the payload is not immediate and only fires on that specific wp-admin page, and the attacker must already hold a low-privileged account on the target site (for example through open registration). There is no public exploit code identified at time of analysis and the CVE is not listed in CISA KEV; the assessment is that this is a genuinely moderate, not high-priority, issue.
Stored cross-site scripting in the Social Share Buttons & Analytics plugin - GetSocial.io for WordPress (all versions up to and including 4.5) lets an authenticated attacker with at least subscriber-level access save arbitrary JavaScript through the 'response' parameter into the gs-alert-msg, gs-alert-utm and gs-alert-cta options, which then executes in an administrator's browser when the GetSocial settings page is opened. Exploitation is constrained: the payload is not immediate and only fires on that specific wp-admin page, and the attacker must already hold a low-privileged account on the target site (for example through open registration). There is no public exploit code identified at time of analysis and the CVE is not listed in CISA KEV; the assessment is that this is a genuinely moderate, not high-priority, issue.