Threat Entry Updated 2025-02-25

CVE-2024-13883 - Wpupper Share Buttons Plugin

The WPUpper Share Buttons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.51. This is due to missing or incorrect nonce validation on the 'save_custom_css_request' function. This makes it possible for unauthenticated attackers to inject custom CSS to modify a site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

PLUGIN Wpupper Share Buttons

CVE-2024-13883

MEDIUM CVSS 4.3 2025-02-21

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-21

CVE-2024-4997 - Wpupper Share Buttons Plugin

The WPUpper Share Buttons plugin for WordPress is vulnerable to unauthorized access of data when preparing sharing links for posts and pages in all versions up to, and including, 3.43. This makes it possible for unauthenticated attackers to obtain the contents of password protected posts and pages.

PLUGIN Wpupper Share Buttons

CVE-2024-4997

MEDIUM CVSS 5.3 2024-06-04

Risk Score

Open Full Technical Breakdown