Vulnerability · Published Apr 11, 2022 · Assigned by WPScan
CVE-2021-24987Super Socializer < 7.13.30 - Reflected Cross-Site Scripting
Medium 6.1
In plain English
A medium-severity cross-site scripting in Social Share, Social Login and Social Comments Plugin – Super Socializer from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 80% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Official description
The Social Share, Social Login and Social Comments Plugin WordPress plugin before 7.13.30 does not sanitise and escape the urls parameter in its the_champ_sharing_count AJAX action (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Social Share, Social Login and Social Comments Plugin – Super Socializer | 7.13.30 – before 7.13.30 |
Weakness: CWE-79