Wp Social Sharing Vulnerabilities

[en] The WP Social Sharing WordPress plugin through 2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Affected:

up to 2.2

Fix:

No patched version reported

Disclosed:

Jan 2, 2023

CVE-2022-4198 on NVD →

The WP Social Sharing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an unknown parameter in versions up to, and including, 2.2 due to insufficient input sanitization and output escaping. This makes it possible for administrator-level attackers to inject arbitrary web scripts in pages that will e...

CVSS:

5.5

Affected:

up to 2.2

Fix:

No patched version reported

Disclosed:

Dec 7, 2022

CVE-2022-4198 on NVD →

Deactivate and delete. This plugin has been closed as of December 6, 2022 and is not available for download. This closure is temporary, pending a full review. zhangyunpei discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress WP Social Sharing Plugin. This could allow a malicious actor to in...

Affected:

up to 2.2

Fix:

No patched version reported