Cross-Site Request Forgery Vulnerability in WPUpper Share Buttons Plugin for WordPress
CVE-2024-13883

4.3MEDIUM

Key Information:

Vendor
Victorfreitas
Status
WPupper Share Buttons
Vendor
CVE Published:
21 February 2025

Summary

The WPUpper Share Buttons plugin for WordPress suffers from a vulnerability that allows unauthenticated attackers to exploit missing or incorrect nonce validation in the 'save_custom_css_request' function. This security gap permits the injection of custom CSS through a forged request, which can alter the appearance and functionality of a website. Attackers can potentially trick site administrators into executing such actions by manipulating links, placing sensitive data at risk and undermining the integrity of web applications.

Affected Version(s)

WPUpper Share Buttons * <= 3.51

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/wpupper-share-...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Noah Stead
.