CVE-2021-24486: Simple Social Media Share Buttons < 3.2.3 - Contributor+ Stored XSS

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-08-23 · updated 2026-06-17
Weakness: CWE-79

Description

The Simple Social Media Share Buttons – Social Sharing for Everyone WordPress plugin before 3.2.3 did not escape the align and like_button_size parameters of its SSB shortcode, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks.

Affected products

WPBrigade Simple Social Media Share Buttons: before 3.2.3 — fixed in 3.2.3

How to fix

Upgrade to a fixed version: WPBrigade Simple Social Media Share Buttons 3.2.3. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/324e6b7b-a2ac-4c08-8b97-0967513f7328
https://wpscan.com/vulnerability/324e6b7b-a2ac-4c08-8b97-0967513f7328

Get alerted when CVE-2021-24486 or the next vulnerability affects your stack