Shareaholic Vulnerabilities

The Professional Social Sharing Buttons, Icons & Related Posts – Shareaholic plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'accept_terms_of_service' function in all versions up to, and including, 9.7.11. This makes it possible for authenticated attacker...

CVSS:

4.3

Affected:

up to 9.7.11

Fixed in:

9.7.12

Disclosed:

Jan 31, 2024

CVE-2024-24709 on NVD →

The Shareaholic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'shareaholic' shortcode in versions up to, and including, 9.7.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and abov...

CVSS:

6.4

Affected:

up to 9.7.8

Fixed in:

9.7.9

Disclosed:

Nov 14, 2023

CVE-2023-4889 on NVD →

The Professional Social Sharing Buttons, Icons & Related Posts WordPress plugin before 9.7.6 does not have proper authorisation check in one of the AJAX action, available to unauthenticated (in v < 9.7.5) and author+ (in v9.7.5) users, allowing them to call it and retrieve various information such as the list of active...

CVSS:

5.3

Affected:

up to 9.7.5

Fixed in:

9.7.6

Disclosed:

Jul 4, 2022

CVE-2022-0594 on NVD →

Cross-site scripting (XSS) vulnerability in admin.php in the Shareaholic plugin before 7.6.1.0 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the location[id] parameter in a shareaholic_add_location action to wp-admin/admin-ajax.php.

CVSS:

5.4

Affected:

up to 7.6.1.0

Fixed in:

7.6.1.0

Disclosed:

Apr 7, 2015

CVE-2014-9311 on NVD →