CVE-2023-4842: XSS
First published: Tue Nov 07 2023(Updated: )
The Social Sharing Plugin - Social Warfare plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'social_warfare' shortcode in versions up to, and including, 4.4.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| <=4.4.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.wordfence.com/threat-intel/vulnerabilities/id/8f5b9aff-0833-4887-ae59-df5bc88c7f91?source=cve
- https://plugins.trac.wordpress.org/browser/social-warfare/tags/4.4.1/lib/buttons-panel/SWP_Buttons_Panel_Trait.php#L304
- https://plugins.trac.wordpress.org/browser/social-warfare/tags/4.4.1/lib/buttons-panel/SWP_Buttons_Panel_Trait.php#L877
- https://plugins.trac.wordpress.org/changeset/2982662/social-warfare#file0
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID of this vulnerability is CVE-2023-4842.
What is the title of this vulnerability?
The title of this vulnerability is 'The Social Sharing Plugin - Social Warfare plugin for WordPress is vulnerable to Stored Cross-Site S...'.
What is the severity of CVE-2023-4842?
The severity of CVE-2023-4842 is medium (6.4).
Which software versions are affected by CVE-2023-4842?
Versions up to, and including, 4.4.3 of the Social Warfare plugin for WordPress are affected by CVE-2023-4842.
What is the CWE ID of CVE-2023-4842?
The CWE ID of CVE-2023-4842 is 79.
- agent/references
- agent/type
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/author
- agent/remedy
- agent/severity
- agent/description
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- agent/event
- vendor/warfareplugins
- canonical/warfareplugins social warfare
- version/warfareplugins social warfare/4.4.3