Wpupper Share Buttons Vulnerabilities

The WPUpper Share Buttons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.51. This is due to missing or incorrect nonce validation on the 'save_custom_css_request' function. This makes it possible for unauthenticated attackers to inject custom CSS to modify a sit...

CVSS:

4.3

Affected:

up to 3.51

Fixed in:

3.52

Disclosed:

Feb 20, 2025

CVE-2024-13883 on NVD →

The WPUpper Share Buttons plugin for WordPress is vulnerable to unauthorized access of data when preparing sharing links for posts and pages in all versions up to, and including, 3.43. This makes it possible for unauthenticated attackers to obtain the contents of password protected posts and pages.

CVSS:

5.3

Affected:

up to 3.43

Fixed in:

3.50

Disclosed:

Jun 3, 2024

CVE-2024-4997 on NVD →

The WPUpper Share Buttons plugin for WordPress is vulnerable to Authenticated (Admin+) Stored Cross-Site Scripting via the plugin's settings in versions up to, and including, 3.42 due to insufficient input sanitization and output escaping. This makes it possible for adminitrator-level attackers to inject arbitrary web...

CVSS:

5.5

Affected:

up to 3.42

Fixed in:

3.43

Disclosed:

Nov 10, 2022

CVE-2022-3838 on NVD →