Cross-Site Request Forgery and XSS Vulnerabilities in Simple Share Buttons Adder Plugin for WordPress
CVE-2014-4717

Currently unrated

Key Information:

Vendor
Wordpress
Status
Simple Share Buttons Adder
Vendor
CVE Published:
3 July 2014

Summary

The Simple Share Buttons Adder plugin prior to version 4.5 for WordPress is affected by multiple cross-site request forgery vulnerabilities. These flaws allow remote attackers to exploit administrator sessions and perform unauthorized actions. Attackers can hijack authentication through malicious requests related to various parameters, including ssba_share_text within the save action on wp-admin/options-general.php. These vulnerabilities can lead to cross-site scripting (XSS) attacks across different site sections such as posts, pages, categories, and post excerpts, impacting site integrity and user data security.

References

http://packetstormsecurity.com/files/127238/WordPress-Sim...
x_refsource_MISC
https://security.dxw.com/advisories/csrf-and-stored-xss-i...
x_refsource_MISC
https://wordpress.org/plugins/simple-share-buttons-adder/...
x_refsource_CONFIRM

Timeline

  • Vulnerability Reserved

  • Vulnerability published

.