Super Socializer Vulnerabilities

The Social Share, Social Login and Social Comments Plugin – Super Socializer plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 7.14.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVSS:

7.2

Affected:

up to 7.14.5

Fix:

No patched version reported

Disclosed:

Jul 28, 2026

CVE-2026-65544 on NVD →

The Social Share, Social Login and Social Comments Plugin – Super Socializer plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 7.14.5. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 7.14.5

Fix:

No patched version reported

Disclosed:

Jul 28, 2026

CVE-2026-65542 on NVD →

The Social Share, Social Login and Social Comments Plugin – Super Socializer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'heateor_mastodon_share' parameter in all versions up to, and including, 7.14.5 due to insufficient input sanitization and output escaping. This makes it possible for...

CVSS:

6.1

Affected:

up to 7.14.5

Fix:

No patched version reported

Disclosed:

Jul 7, 2026

CVE-2026-11798 on NVD →

[en] The Social Share, Social Login and Social Comments Plugin – Super Socializer plugin for WordPress is vulnerable to Limited SQL Injection via the ‘SuperSocializerKey’ parameter in all versions up to, and including, 7.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation o...

Affected:

up to 7.14.1

Fixed in:

7.14.1

Disclosed:

Jan 21, 2025

CVE-2024-13230 on NVD →

The Social Share, Social Login and Social Comments Plugin – Super Socializer plugin for WordPress is vulnerable to Limited SQL Injection via the ‘SuperSocializerKey’ parameter in all versions up to, and including, 7.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVSS:

5.3

Affected:

up to 7.14

Fixed in:

7.14.1

Disclosed:

Jan 20, 2025

CVE-2024-13230 on NVD →

[en] Missing Authorization vulnerability in Team Heateor Super Socializer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Super Socializer: from n/a through 7.13.54.

Affected:

up to 7.13.55

Fixed in:

7.13.55

Disclosed:

Dec 13, 2024

CVE-2023-41802 on NVD →

[en] The Social Share, Social Login and Social Comments Plugin – Super Socializer plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 7.13.68. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthent...

Affected:

up to 7.14

Fixed in:

7.14

Disclosed:

Nov 6, 2024

CVE-2024-9946 on NVD →

The Social Share, Social Login and Social Comments Plugin – Super Socializer plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 7.13.68. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticate...

CVSS:

8.1

Affected:

up to 7.13.68

Fixed in:

7.14

Disclosed:

Nov 5, 2024

CVE-2024-9946 on NVD →

[en] The Social Share, Social Login and Social Comments Plugin WordPress plugin before 7.13.64 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

Affected:

up to 7.13.64

Fixed in:

7.13.64

Disclosed:

Apr 15, 2024

CVE-2024-2836 on NVD →

The Social Share, Social Login and Social Comments Plugin – Super Socializer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 7.13.63 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVSS:

4.4

Affected:

up to 7.13.63

Fixed in:

7.13.64

Disclosed:

Mar 25, 2024

CVE-2024-2836 on NVD →

The Super Socializer plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on several functions such as heateor_ss_twitcount_notification_read, heateor_ss_gdpr_notification_read, heateor_ss_fb_redirection_notification_read, heateor_ss_twitter_callback_notification_read...

CVSS:

4.3

Affected:

up to 7.13.54

Fixed in:

7.13.55

Disclosed:

Sep 5, 2023

CVE-2023-41802 on NVD →

The Super Socializer plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce checks on several functions such as heateor_ss_twitcount_notification_read, heateor_ss_gdpr_notification_read, heateor_ss_fb_redirection_notification_read, heateor_ss_twitter_callback_notification_read, heateor_ss...

CVSS:

4.3

Affected:

up to 7.13.54

Fixed in:

7.13.55

Disclosed:

Sep 5, 2023

CVE-2023-41802 on NVD →

Update the WordPress Super Socializer plugin to the latest available version (at least 7.13.54). Unknown discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Super Socializer Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and othe...

Affected:

up to 7.13.54

Fixed in:

7.13.54

Disclosed:

Jul 12, 2023

The Super Socializer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugins [TheChamp-Counter] and [TheChamp-Sharing] shortcodes in versions up to, and including, 7.13.53 due to insufficient input sanitization and output escaping on the url user supplied attribute. This makes it possible for...

CVSS:

6.4

Affected:

up to 7.13.53

Fixed in:

7.13.54

Disclosed:

Jul 11, 2023

The Super Socializer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugins [TheChamp-Counter] and [TheChamp-Sharing] shortcodes in versions up to, and including, 7.13.53 due to insufficient input sanitization and output escaping on the url user supplied attribute. This makes it possible for...

Affected:

up to 7.13.54

Fixed in:

7.13.54

Disclosed:

Jul 11, 2023

[en] Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Team Heateor Super Socializer plugin <= 7.13.52 versions.

Affected:

up to 7.13.53

Fixed in:

7.13.53

Disclosed:

Jun 20, 2023

CVE-2023-35882 on NVD →

The Super Socializer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions up to, and including, 7.13.52 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level...

CVSS:

6.4

Affected:

up to 7.13.52

Fixed in:

7.13.53

Disclosed:

Jun 19, 2023

CVE-2023-35882 on NVD →

[en] The Social Share, Social Login and Social Comments WordPress plugin before 7.13.52 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Affected:

up to 7.13.52

Fixed in:

7.13.52

Disclosed:

Jun 19, 2023

CVE-2023-2779 on NVD →

The Social Share, Social Login and Social Comments plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the $targetUrls value in versions up to, and including, 7.13.51 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

CVSS:

6.1

Affected:

up to 7.13.52

Fixed in:

7.13.52

Disclosed:

May 29, 2023

CVE-2023-2779 on NVD →

[en] The Social Share, Social Login and Social Comments Plugin WordPress plugin before 7.13.44 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be us...

Affected:

up to 7.13.44

Fixed in:

7.13.44

Disclosed:

Jan 16, 2023

CVE-2022-4484 on NVD →

The Super Socializer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in versions up to, and including, 7.13.44 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level a...

CVSS:

6.4

Affected:

up to 7.13.44

Fixed in:

7.13.45

Disclosed:

Dec 23, 2022

CVE-2022-4484 on NVD →

[en] The Social Share, Social Login and Social Comments Plugin WordPress plugin before 7.13.30 does not sanitise and escape the urls parameter in its the_champ_sharing_count AJAX action (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Si...

Affected:

up to 7.13.30

Fixed in:

7.13.30

Disclosed:

Apr 11, 2022

CVE-2021-24987 on NVD →

The Social Share, Social Login and Social Comments Plugin WordPress plugin before 7.13.30 does not sanitise and escape the urls parameter in its the_champ_sharing_count AJAX action (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Sc...

CVSS:

6.1

Affected:

up to 7.13.30

Fixed in:

7.13.30

Disclosed:

Mar 15, 2022

CVE-2021-24987 on NVD →

Bypass vulnerability discovered by NinTechNet in WordPress Super Socializer plugin (versions <= 7.12.37).

Affected:

up to 7.12.38

Fixed in:

7.12.38

Disclosed:

Feb 14, 2020

Authentication Bypass vulnerability found in WordPress Super Socializer plugin (versions <=7.10.6).

Affected:

up to 7.11

Fixed in:

7.11

Disclosed:

Mar 15, 2018

The Social Share, Social Login and Social Comments plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the 'the_champ_user_auth' AJAX action in versions up to, and including, 7.10.6. This makes it possible for unauthenticated attackers to log in as any user, assuming they kno...

CVSS:

9.8

Affected:

up to 7.10.6

Fixed in:

7.11

Disclosed:

Mar 3, 2018

The Social Share, Social Login and Social Comments plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the 'the_champ_user_auth' AJAX action in versions up to, and including, 7.10.6. This makes it possible for unauthenticated attackers to log in as any user, assuming they kno...

Affected:

up to 7.11

Fixed in:

7.11

Disclosed:

Mar 3, 2018

The the_champ_user_auth AJAX action of the plugin could allow unauthenticated attackers to login as any user by just knowing their email address

Affected:

up to 7.13.30

Fixed in:

7.13.30