Acurax Social Media Widget Vulnerabilities

[en] The acx_asmw_saveorder_callback function in function.php in the acurax-social-media-widget plugin before 3.2.6 for WordPress has CSRF via the recordsArray parameter to wp-admin/admin-ajax.php, with resultant social_widget_icon_array_order XSS.

Affected:

up to 3.2.6

Fixed in:

3.2.6

Disclosed:

Jan 27, 2018

CVE-2018-6357 on NVD →

The acx_asmw_saveorder_callback function in function.php in the acurax-social-media-widget plugin before 3.2.6 for WordPress has CSRF via the recordsArray parameter to wp-admin/admin-ajax.php, with resultant social_widget_icon_array_order XSS.

CVSS:

8.8

Affected:

up to 3.2.6

Fixed in:

3.2.6

Disclosed:

Jan 2, 2018

CVE-2018-6357 on NVD →

The Social Media Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'acx_widget_si_theme', 'acx_widget_si_twitter', 'acx_widget_si_facebook', 'acx_widget_si_youtube', 'acx_widget_si_linkedin', 'acx_widget_si_gplus', 'acx_widget_si_credit', 'acx_widget_si_icon_size', 'acx_widget_si_pinteres...

CVSS:

6.4

Affected:

up to 2.2

Fixed in:

2.3

Disclosed:

Aug 21, 2015

The Social Media Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'acx_widget_si_theme', 'acx_widget_si_twitter', 'acx_widget_si_facebook', 'acx_widget_si_youtube', 'acx_widget_si_linkedin', 'acx_widget_si_gplus', 'acx_widget_si_credit', 'acx_widget_si_icon_size', 'acx_widget_si_pinteres...

Affected:

up to 2.3

Fixed in:

2.3

Disclosed:

Aug 21, 2015

The Social Media Widget by Acurax plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘acx_si_theme, acx_si_twitter, acx_si_facebook, acx_si_youtube, acx_si_linkedin, acx_si_gplus, acx_si_credi, $acx_si_icon_size, acx_si_display, acx_si_pinterest, acx_si_feed’ parameters in versions up to, and inc...

CVSS:

7.2

Affected:

up to 2.2

Fixed in:

2.2

Disclosed:

Aug 19, 2015

The Social Media Widget by Acurax plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘acx_si_theme, acx_si_twitter, acx_si_facebook, acx_si_youtube, acx_si_linkedin, acx_si_gplus, acx_si_credi, $acx_si_icon_size, acx_si_display, acx_si_pinterest, acx_si_feed’ parameters in versions up to, and inc...

Affected:

up to 2.2

Fixed in:

2.2

Disclosed:

Aug 19, 2015

The Social Media Widget by Acurax WordPress plugin was affected by an Authenticated Stored Cross-Site Scripting (XSS) security vulnerability.

Affected:

up to 2.3

Fixed in:

2.3