Mashsharer Vulnerabilities

The MashShare – Social Media Share Buttons, Social Share Icons plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 4.0.47. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an...

CVSS:

4.3

Affected:

up to 4.0.47

Fix:

No patched version reported

Disclosed:

Jan 3, 2025

CVE-2025-22319 on NVD →

The Social Media Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcode in versions up to, and including, 3.8.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject a...

CVSS:

6.4

Affected:

up to 3.8.6

Fixed in:

3.8.7

Disclosed:

Dec 23, 2022

CVE-2022-4544 on NVD →

The Social Media Share Buttons plugin for WordPress is vulnerable to stored cross-site scripting in versions up to, and including, 3.8.3, due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions, to inject arbitrary web scripts...

CVSS:

5.5

Affected:

up to 3.8.3

Fixed in:

3.8.4

Disclosed:

Aug 19, 2022

Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in René Hermenau's Social Media Share Buttons plugin <= 3.8.1 at WordPress.

CVSS:

5.5

Affected:

up to 3.8.1

Fixed in:

3.8.2

Disclosed:

Jun 16, 2022

CVE-2021-36849 on NVD →

The Social Media Share Buttons | MashShare plugin for WordPress is vulnerable to Information Disclosure in versions before 2.3.1 via the mashsb_process_actions function. This can allow unauthenticated attackers to extract sensitive data including configuration information.

CVSS:

5.3

Affected:

up to 2.3.1

Fixed in:

2.3.1

Disclosed:

Apr 25, 2015