WordPress CVEs

Description

The Social Media Widget WordPress plugin before 4.0.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Affected WordPress components

• Social Media Widget Plugin · social-media-widget
  Possible match Abandoned
  Before 4.0.9
  View on WordPress.org
• Social Media Widget Plugin · social-media-widget-icon
  Possible match Abandoned
  Before 4.0.9
  View on WordPress.org
• Social Media Widget Plugin · social-media-widgets
  Possible match Abandoned
  Before 4.0.9
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• Unknown Social Media Widget — Before 4.0.9
• noahkagan social_media_widget — Before 4.0.9
• bmwebproperties social_media_widget — Before 4.0.9

References

• wpscan.com https://wpscan.com/vulnerability/7f8e5e63-a928-443e-9771-8b3f51f5eb9e/ Exploit, Third Party Advisory
• nvd.nist.gov Official NVD record