WordPress Plugin Vulnerabilities

Floating Social Media Icon <= 4.3.5 - Admin+ Stored Cross-Site Scripting

Description

The plugin does not sanitise some parameter in the Social media Configuration form, which could allow high privilege users to perform Cross-Site Scripting

Affects Plugins

Plugin icon
floating-social-media-icon
No known fix

References

CVE
CVE-2021-36843

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
3.5 (low)

Miscellaneous

Verified
No
WPVDB ID
66677c18-fa7d-4201-89e4-3df99e7eb298

Timeline

Publicly Published
2021-10-27 (about 4 years ago)
Added
2021-11-27 (about 4 years ago)
Last Updated
2022-04-30 (about 4 years ago)

Other

Published
Title
Published
2025-12-17
Title
OpenID Connect Generic Client < 3.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Published
2017-09-26
Title
Content Audit <= 1.9.1 - Cross-Site Scripting (XSS) & CSRF
Published
2024-11-22
Title
Advanced Event Manager <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-12-19
Title
Spotlightr < 0.1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-02-02
Title
EP4 More Embeds <= 1.0.0 - Unauthenticated Stored Cross-Site Scripting