Social Rocket – Social Sharing Plugin <= 1.3.4.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via id
medium
The Social Rocket – Social Sharing Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.3.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access an...
- CVSS:
- 6.4
- Affected:
- up to 1.3.4.2
- Fixed in:
- 1.3.5
- Disclosed:
- Apr 22, 2026
CVE-2026-1923 on NVD →
Social Rocket – Social Sharing Plugin <= 1.3.4 - Missing Authorization to Settings Update
medium
The Social Rocket – Social Sharing Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tweet_settings_save() and tweet_settings_update() functions in all versions up to, and including, 1.3.4. This makes it possible for authenticated attackers, with Sub...
- CVSS:
- 5.3
- Affected:
- up to 1.3.4
- Fixed in:
- 1.3.4.1
- Disclosed:
- Jan 6, 2025
CVE-2024-9697 on NVD →
Social Rocket <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
medium
The Social Rocket – Social Sharing Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'socialrocket-floating' shortcode in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for au...
- CVSS:
- 6.4
- Affected:
- up to 1.3.4
- Fixed in:
- 1.3.4.1
- Disclosed:
- Jan 6, 2025
CVE-2024-9702 on NVD →
Social Rocket – Social Sharing Plugin [social-rocket] < 1.3.4 (closed)
unknown
[en] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Social Rocket allows Reflected XSS.This issue affects Social Rocket: from n/a through 1.3.3.
- Affected:
- up to 1.3.4
- Fixed in:
- 1.3.4
- Disclosed:
- Jul 22, 2024
CVE-2024-37258 on NVD →
Social Rocket <= 1.3.3 - Reflected Cross-Site Scripting
medium
The Social Rocket plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.3.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully t...
- CVSS:
- 6.1
- Affected:
- up to 1.3.3
- Fixed in:
- 1.3.4
- Disclosed:
- Jun 27, 2024
CVE-2024-37258 on NVD →
Social Rocket – Social Sharing Plugin [social-rocket] < 1.3.3 (closed)
unknown
[en] The Social Rocket WordPress plugin before 1.3.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Affected:
- up to 1.3.3
- Fixed in:
- 1.3.3
- Disclosed:
- Oct 10, 2022
CVE-2022-3136 on NVD →
Social Rocket <= 1.3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
medium
The Social Rocket plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of its settings parameters in versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and abov...
- CVSS:
- 5.5
- Affected:
- up to 1.3.2
- Fixed in:
- 1.3.3
- Disclosed:
- Sep 19, 2022
CVE-2022-3136 on NVD →
Social Rocket – Social Sharing Plugin [social-rocket] < 1.2.10 (closed)
unknown
[en] Cross-site request forgery (CSRF) vulnerability in Social Sharing Plugin versions prior to 1.2.10 allows remote attackers to hijack the authentication of administrators via unspecified vectors.
- Affected:
- up to 1.2.10
- Fixed in:
- 1.2.10
- Disclosed:
- Jul 27, 2020
CVE-2020-5611 on NVD →
Social Rocket <= 1.2.9 - Cross-Site Request Forgery
high
The Social Rocket plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.9. This is due to missing or incorrect nonce validation on the admin_settings_post_actions() function. This makes it possible for unauthenticated attackers to gain access to otherwise restricted admi...
- CVSS:
- 8.8
- Affected:
- up to 1.2.9
- Fixed in:
- 1.2.10
- Disclosed:
- Jul 22, 2020
Social Rocket – Social Sharing Plugin < 1.2.10 - Cross-Site Request Forgery
high
Cross-site request forgery (CSRF) vulnerability in Social Sharing Plugin versions prior to 1.2.10 allows remote attackers to hijack the authentication of administrators via unspecified vectors.
- CVSS:
- 8.8
- Affected:
- up to 1.2.10
- Fixed in:
- 1.2.10
- Disclosed:
- Jul 22, 2020
CVE-2020-5611 on NVD →
Social Rocket – Social Sharing Plugin [social-rocket] < 1.2.10 (closed)
unknown
The Social Rocket plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.9. This is due to missing or incorrect nonce validation on the admin_settings_post_actions() function. This makes it possible for unauthenticated attackers to gain access to otherwise restricted admi...
- Affected:
- up to 1.2.10
- Fixed in:
- 1.2.10
- Disclosed:
- Jul 22, 2020
Social Rocket – Social Sharing Plugin [social-rocket] <= 1.3.4 (unfixed + closed)
unknown
- Affected:
- up to 1.3.4
- Fix:
- No patched version reported
CVE-2024-9702 on NVD →
Social Rocket – Social Sharing Plugin [social-rocket] <= 1.3.4 (unfixed + closed)
unknown
- Affected:
- up to 1.3.4
- Fix:
- No patched version reported
CVE-2024-9697 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database