Shariff Sharing Vulnerabilities

The Shariff Sharing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘shariff_image' parameter in versions before 1.0.8 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts in pages that will execute whenever a user acc...

CVSS:

7.2

Affected:

up to 1.0.8

Fixed in:

1.0.8

Disclosed:

Dec 5, 2014

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Update the plugin.

Affected:

up to 1.0.8

Fixed in:

1.0.8

Disclosed:

Dec 5, 2014

The Shariff Sharing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘shariff_image' parameter in versions before 1.0.8 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts in pages that will execute whenever a user acc...

Affected:

up to 1.0.8

Fixed in:

1.0.8

Disclosed:

Dec 5, 2014

On the "Settings > Shariff" screen, the input field 'shariff_image' is saved without any validation. Malicious JavaScript can be injected. Screenshots: http://imgur.com/hipNRLW http://imgur.com/N6djVaE

Affected:

up to 1.0.8

Fixed in:

1.0.8