WordPress Plugin Vulnerabilities

Simple Share Buttons Adder <= 6.0.0 - Reflected Cross-Site Scripting (XSS)

Description

A reflected XSS in "Simple Share Buttons Adder" before version 6.0.1 lead to a reflected cross-site scripting vulnerability on all pages where the "Simple Share Buttons Adder" was added (usually all blog posts).

Exploitation required that the browser did not encode the parameters sent to the server. Most prominently this thus affects Internet Explorer but is not exploitable on recent versions of Chrome or Firefox.

Proof of Concept

Affects Plugins

Plugin icon
simple-share-buttons-adder
Fixed in 6.0.1

References

CVE
CVE-2015-9303
URL
https://wordpress.org/plugins/simple-share-buttons-adder/

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.1 (medium)

Miscellaneous

Submitter
Lukas Reschke
Submitter website
https://www.owncloud.com
Verified
No
WPVDB ID
5c1c515f-7c0f-441b-abee-71fd4b457bf7

Timeline

Publicly Published
2015-06-02 (about 10 years ago)
Added
2015-06-02 (about 10 years ago)
Last Updated
2020-09-22 (about 5 years ago)

Other

Published
Title
Published
2024-05-14
Title
WPZOOM Addons for Elementor (Templates, Widgets) < 1.1.37 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Box Widget
Published
2023-07-26
Title
Your Journey theme <= 1.9.8 - Reflected Cross-Site Scripting via Prototype Pollution
Published
2025-12-05
Title
Canadian Nutrition Facts Label <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Nutrition Label Custom Post Type
Published
2024-07-10
Title
WooCommerce Predictive Search < 6.1.0 - Reflected Cross-Site Scripting
Published
2025-03-25
Title
Amazing service box Addons For WPBakery Page Builder <= 2.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload