Social Media Share Buttons & Social Sharing Icons < 2.8.2 - Admin+ Stored XSS

2023-06-0500:00:00

Mohamed Selim

social media

share buttons

stored xss

admin+

settings

exploit

0.001 Low

EPSS

Percentile

23.3%

JSON

The plugin does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).

Put the payload in any text field of the "8 Do you want to show a subscription form (increases sign-ups)? » Text above the entry field » Text" settings and save: " style=animation-name:rotation onanimationstart=alert(/XSS/)//

The XSS will be triggered when reaccessing the settings.

0.001 Low

EPSS

Percentile

23.3%

JSON

Related for WPEX-ID:090DBDF4-61E2-4B51-A3E2-76096596C514