The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.5. This is due to missing or incorrect nonce validation on several functions corresponding to AJAX actions. This makes it possible for unauthenticated attackers to invoke those actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
References
Configurations
Configuration 1 (hide)
|
History
30 Oct 2023, 11:18
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://plugins.trac.wordpress.org/changeset/2975574/ultimate-social-media-icons/tags/2.8.6/libs/controllers/sfsi_buttons_controller.php?old=2956446&old_path=ultimate-social-media-icons%2Ftags%2F2.8.5%2Flibs%2Fcontrollers%2Fsfsi_buttons_controller.php - Patch | |
| References | (MISC) https://www.wordfence.com/threat-intel/vulnerabilities/id/d44a45fb-3bff-4a1f-8319-a58a47a9d76b?source=cve - Product, Third Party Advisory | |
| CPE | cpe:2.3:a:ultimatelysocial:social_media_share_buttons_\&_social_sharing_icons:*:*:*:*:*:wordpress:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
| CWE | CWE-352 | |
| First Time |
Ultimatelysocial social Media Share Buttons \& Social Sharing Icons
Ultimatelysocial |
20 Oct 2023, 08:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-10-20 08:15
Updated : 2023-11-07 04:24
NVD link : CVE-2023-5602
Mitre link : CVE-2023-5602
JSON object : View
Products Affected
ultimatelysocial
- social_media_share_buttons_\&_social_sharing_icons
CWE
CWE-352
Cross-Site Request Forgery (CSRF)