CVE-2021-24987: Super Socializer < 7.13.30 - Reflected Cross-Site Scripting
The Social Share, Social Login and Social Comments Plugin WordPress plugin before 7.13.30 does not sanitise and escape the urls parameter in its thechampsharingcount AJAX action (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-24987?
CVE-2021-24987 is a vulnerability found in the Social Share, Social Login and Social Comments Plugin WordPress plugin before version 7.13.30.
What is the severity of CVE-2021-24987?
The severity of CVE-2021-24987 is rated as medium with a CVSS score of 6.1.
How does CVE-2021-24987 affect the software?
CVE-2021-24987 affects the Social Share, Social Login and Social Comments Plugin WordPress plugin before version 7.13.30.
Is CVE-2021-24987 exploitable by unauthenticated users?
Yes, CVE-2021-24987 can be exploited by both unauthenticated and authenticated users.
How can I fix CVE-2021-24987?
To fix CVE-2021-24987, update the Social Share, Social Login and Social Comments Plugin WordPress plugin to version 7.13.30 or above.