CVE-2015-9439

Severity: medium (CVSS 4.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-09-26 · updated 2026-06-17
Weakness: CWE-79

Description

The addthis plugin before 5.0.13 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=addthis_social_widget pubid parameter.

Affected products

Addthis: before 5.0.13 — fixed in 5.0.13

How to fix

Upgrade to a fixed version: Addthis 5.0.13. Check the vendor advisory for mitigations.

References

http://blog.cinu.pl/2015/11/php-static-code-analysis-vs-top-1000-wordpress-plugins.html
https://wordpress.org/plugins/addthis/#developers
https://wpvulndb.com/vulnerabilities/8246
http://blog.cinu.pl/2015/11/php-static-code-analysis-vs-top-1000-wordpress-plugins.html
https://wordpress.org/plugins/addthis/#developers
https://wpvulndb.com/vulnerabilities/8246

Get alerted when CVE-2015-9439 or the next vulnerability affects your stack