blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2021-24656

MEDIUM 4.8 CVSS 3.1
Published
October 11, 2021
Last modified
June 17, 2026
NVD status
Modified
Reported by
contact@wpscan.com
Weakness
CWE-79
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Description

The Simple Social Media Share Buttons WordPress plugin before 3.2.4 does not escape the Share Title settings before outputting it in the frontend pages or posts (depending on the settings used), allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

Affected products and versions

  • Unknown Simple Social Media Share Buttons – Social Sharing for Everyone — From 3.2.4 (including) to 3.2.4 (excluding)
  • wpbrigade simple_social_buttons — Before 3.2.4

References

  • wpscan.com https://wpscan.com/vulnerability/8e897dcc-6e52-440b-83ad-b119c55751c7 Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record