Social Share Icons Social Share Buttons
Monthly
Unauthenticated cross-site scripting in the WordPress plugin Social Share Icons & Social Share Buttons (versions <= 3.7.5) lets remote attackers inject script that executes in the browser of a site visitor or administrator who interacts with the crafted content, scoring CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). Because the plugin is embedded on public-facing WordPress pages, any site running an affected version is exposed, and per the CVSS vector the attacker needs no credentials (PR:N) but must convince a victim to take an action such as clicking a crafted link (UI:R), with the scope change (S:C) meaning the injected script can affect resources beyond the vulnerable component. No public exploit code and no confirmed active exploitation were identified at time of analysis, and there is no vendor-released patch version documented in the available references, so sites should treat the plugin's 3.7.5 release line as vulnerable until a fixed version is published.
Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handle_installation function that is called via the. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
Unauthenticated cross-site scripting in the WordPress plugin Social Share Icons & Social Share Buttons (versions <= 3.7.5) lets remote attackers inject script that executes in the browser of a site visitor or administrator who interacts with the crafted content, scoring CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). Because the plugin is embedded on public-facing WordPress pages, any site running an affected version is exposed, and per the CVSS vector the attacker needs no credentials (PR:N) but must convince a victim to take an action such as clicking a crafted link (UI:R), with the scope change (S:C) meaning the injected script can affect resources beyond the vulnerable component. No public exploit code and no confirmed active exploitation were identified at time of analysis, and there is no vendor-released patch version documented in the available references, so sites should treat the plugin's 3.7.5 release line as vulnerable until a fixed version is published.
Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handle_installation function that is called via the. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.