Simple Social Media Share Buttons < 3.2.4 – Authenticated Stored Cross-Site Scripting | CVE 2021-24656 | Plugin Vulnerabilities

Description

The plugin does not escape the Share Title settings before outputting it in the frontend pages or posts (depending on the settings used), allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

Proof of Concept

Put the following payload <svg onload=alert(/XSS/)> in the Share Title settings of the plugin (with at least one Social Buttons Designs enabled)

The XSS will be triggered depending on the Post type Settings selected (like just homepage, posts, pages etc)

Affects Plugins

simple-social-buttons

Fixed in 3.2.4

References

CVE

URL

https://www.hackpertise.com/cve/17-cve-2021-24656/

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Asif Nawaz Minhas

Submitter

Asif Nawaz Minhas

Verified

Yes

WPVDB ID

8e897dcc-6e52-440b-83ad-b119c55751c7

Timeline

Publicly Published

2021-09-13 (about 4 years ago)

Added

2021-09-13 (about 4 years ago)

Last Updated

2023-04-12 (about 2 years ago)

Other

Published

Title

Published

2024-12-30

Title

Post Grid Elementor Addon < 2.0.19 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2024-04-16

Title

App Builder < 3.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Published

2025-09-26

Title

WPFront User Role Editor < 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2023-02-15

Title

Zeno Font Resizer < 1.8.0 - Admin+ Stored XSS

Published

2023-11-07

Title

Seo By 10Web <= 1.2.9 - Reflected XSS