Plugin Vulnerable to Reflected Cross-Site Scripting

CVE-2024-8790

What is CVE-2024-8790?

The Social Share With Floating Bar plugin for WordPress is susceptible to Reflected Cross-Site Scripting (XSS) due to inadequate query argument handling. Specifically, the plugin utilizes add_query_arg without appropriate URL escaping, which exposes users to potential web script injection. This vulnerability enables attackers to inject arbitrary scripts into the affected pages, potentially compromising user interactions. Unauthenticated users may exploit this weakness by enticing victims into clicking malicious links, thereby executing harmful scripts within their browsers.

References