Threat Entry Updated 2025-03-06

CVE-2025-1513 - Social Share Buttons Plugin

The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Name and Comment field when commenting on photo gallery entries in all versions up to, and including, 26.0.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Social Share Buttons

CVE-2025-1513

HIGH CVSS 7.2 2025-02-28

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-05-11

CVE-2024-12807 - Social Share Buttons Plugin

The Social Share Buttons for WordPress plugin through 2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

PLUGIN Social Share Buttons

CVE-2024-12807

MEDIUM CVSS 4.8 2025-01-28

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-08

CVE-2024-10687 - Social Share Buttons Plugin

The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal, Social Share Buttons plugin for WordPress is vulnerable to time-based SQL Injection via the $collectedIds parameter in all versions up to, and including, 24.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

PLUGIN Social Share Buttons

CVE-2024-10687

CRITICAL CVSS 9.8 2024-11-05

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-01

CVE-2024-9219 - Social Share Buttons Plugin

The WordPress Social Share Buttons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.19. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

PLUGIN Social Share Buttons

CVE-2024-9219

MEDIUM CVSS 6.1 2024-10-19

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-21

CVE-2022-33960 - Social Share Buttons Plugin

Multiple Authenticated (subscriber or higher user role) SQL Injection (SQLi) vulnerabilities in Social Share Buttons by Supsystic plugin

PLUGIN Social Share Buttons

CVE-2022-33960

HIGH CVSS 8.5 2022-07-22

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-21

CVE-2022-27235 - Social Share Buttons Plugin

Multiple Broken Access Control vulnerabilities in Social Share Buttons by Supsystic plugin

PLUGIN Social Share Buttons

CVE-2022-27235

MEDIUM CVSS 6.3 2022-07-22

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-21

CVE-2022-1653 - Social Share Buttons Plugin

The Social Share Buttons by Supsystic WordPress plugin before 2.2.4 does not perform CSRF checks in it's ajax endpoints and admin pages, allowing an attacker to trick any logged in user to manipulate or change the plugin settings, as well as create, delete and rename projects and networks.

PLUGIN Social Share Buttons

CVE-2022-1653

MEDIUM CVSS 4.3 2022-06-27

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-21

CVE-2021-36890 - Social Share Buttons Plugin

Cross-Site Request Forgery (CSRF) vulnerability in Social Share Buttons by Supsystic plugin

PLUGIN Social Share Buttons

CVE-2021-36890

MEDIUM CVSS 4.3 2022-06-02

Risk Score

Open Full Technical Breakdown