CVE Vulnerability

CVE-2021-24656

The Simple Social Media Share Buttons WordPress plugin before 3.2.4 does not escape the Share Title settings before outputting it in the frontend pages or posts (depending on the settings used), allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

3.5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 6.8 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

4.8 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.7 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://wpscan.com/vulnerability/8e897dcc-6e52-440b-83ad-b119c55751c7 Exploit Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:wpbrigade:simple_social_buttons:*:*:*:*:*:wordpress:*:*
Information

Published : 2021-10-11 11:15

Updated : 2021-10-15 04:29

NVD link : CVE-2021-24656

Mitre link : CVE-2021-24656

Products Affected
No products.
CWE
CWE-79