Stored Cross-Site Scripting Flaw in Sticky Social Icons Plugin for WordPress

CVE-2024-10551

Summary

CVE-2024-10551 is a stored cross-site scripting vulnerability found in the Sticky Social Icons plugin for WordPress, specifically versions up to 1.2.1. This security flaw arises from the plugin's failure to properly sanitize and escape certain settings. As a result, even restricted users (e.g., those without unfiltered HTML capabilities) such as administrators can exploit this vulnerability to inject malicious scripts. This poses significant risks, especially within multisite WordPress installations, where an attacker can spread harmful scripts to multiple sites. It is crucial for users and administrators to update the plugin promptly and implement security best practices to prevent potential exploitations.

References