WP Socializer < 7.3 – Admin+ Stored Cross-Site Scripting | CVE 2022-2763 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape some of its Icons settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Proof of Concept

Activate the Share Icons feature of the plugin, edit one of the Icon settings and put the following payload in the "Text to show next to icon" field: <img src onerror=alert(/XSS/)> 

Save the icon settings, and then the Share Icon settings. The XSS will be triggered in all frontend posts

Affects Plugins

Fixed in 7.3

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Verified

Yes

WPVDB ID

36a7b872-31fa-4375-9be7-8f787e616ed5

Timeline

Publicly Published

2022-09-06 (about 3 years ago)

Added

2022-09-06 (about 3 years ago)

Last Updated

2022-09-06 (about 3 years ago)

Other

Published

Title

Published

2025-01-10

Title

User Messages <= 1.2.4 - Reflected XSS

Published

2024-10-24

Title

WP Abstracts < 2.7.2 - Authenticated (Administrator+) Stored Cross-Site Scripting

Published

2025-05-20

Title

Formulario de contacto SalesUp! <= 1.0.14 - Reflected Cross-Site Scripting

Published

2025-04-24

Title

Carousel-of-post-images <= 1.07 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2023-10-17

Title

Skype Legacy Buttons <= 3.1 - Contributor+ Stored XSS