Stored Cross-Site Scripting Vulnerability in Social Warfare Plugin for WordPress

CVE-2023-4842

Summary

The Social Warfare plugin for WordPress has been found to be vulnerable to Stored Cross-Site Scripting via the 'social_warfare' shortcode, affecting versions up to and including 4.4.3. This vulnerability arises from inadequate input sanitization and output escaping of user-supplied attributes. Authenticated attackers with contributor-level permissions or higher can exploit this weakness to inject malicious web scripts into pages, which will execute when other users visit the compromised pages. This exposure highlights the importance of secure coding practices, particularly around user inputs in web applications.

References