{"id":"CVE-2024-2118","aliases":["EUVD-2024-27082","GHSA-vv98-j6p5-8hj3"],"status":"published","title":"Social Media Share Buttons \u003c 2.8.9 - Admin+ Stored XSS via settings","description":"The Social Media Share Buttons \u0026 Social Sharing Icons WordPress plugin before 2.8.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00405,"percentile":0.35058,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2024-04-17T05:00:02Z","modified":"2026-06-17T07:23:45Z","products":[{"vendor":"inisev","product":"social_media_share_buttons_\\\u0026_social_sharing_icons"},{"vendor":"unknown","product":"social media share buttons \u0026 social sharing icons"}],"references":[{"url":"https://wpscan.com/vulnerability/e9d53cb9-a5cb-49f5-bcba-295ae6fa44c3/","tags":["exploit","vdb-entry","technical-description","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-2118"},{"url":"https://wpscan.com/vulnerability/e9d53cb9-a5cb-49f5-bcba-295ae6fa44c3"},{"url":"https://github.com/advisories/GHSA-vv98-j6p5-8hj3"}],"sources":{"cve":[{"id":"CVE-2024-2118","title":"Social Media Share Buttons \u003c 2.8.9 - Admin+ Stored XSS via settings","description":"The Social Media Share Buttons \u0026 Social Sharing Icons WordPress plugin before 2.8.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)","status":"published","published":"2024-04-17T05:00:02.917Z","modified":"2024-11-22T14:13:23.709Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L","level":"medium","assessor":"adp"}],"updated_at":"2026-11-02T14:34:09.897248Z"}],"euvd":[{"id":"EUVD-2024-27082","description":"The Social Media Share Buttons \u0026 Social Sharing Icons WordPress plugin before 2.8.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)","status":"published","published":"2024-04-17T05:00:02Z","modified":"2024-11-22T14:13:23Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T00:04:50.64101Z"}],"ghsa":[{"id":"GHSA-vv98-j6p5-8hj3","title":"The Social Media Share Buttons \u0026 Social Sharing Icons WordPress plugin before 2.8.9 does not...","description":"The Social Media Share Buttons \u0026 Social Sharing Icons WordPress plugin before 2.8.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)","status":"published","published":"2024-04-17T06:30:52Z","modified":"2025-05-08T21:33:53Z","cvss":[{"version":"3.1","score":0,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:N","level":"none"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:02:13.090331Z"}],"nvd":[{"id":"CVE-2024-2118","description":"The Social Media Share Buttons \u0026 Social Sharing Icons WordPress plugin before 2.8.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)","status":"published","published":"2024-04-17T05:15:48.693Z","modified":"2026-06-17T07:23:45.567Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:09:52.184911Z"}]}}