CVE-2021-24656: Simple Social Media Share Buttons < 3.2.4 - Authenticated Stored Cross-Site Scripting

Severity: medium (CVSS 4.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-10-11 · updated 2026-06-17
Weakness: CWE-79

Description

The Simple Social Media Share Buttons WordPress plugin before 3.2.4 does not escape the Share Title settings before outputting it in the frontend pages or posts (depending on the settings used), allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

Affected products

Simple Social Media Share Buttons: before 3.2.4 — fixed in 3.2.4

How to fix

Upgrade to a fixed version: Simple Social Media Share Buttons 3.2.4. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/8e897dcc-6e52-440b-83ad-b119c55751c7
https://wpscan.com/vulnerability/8e897dcc-6e52-440b-83ad-b119c55751c7

Get alerted when CVE-2021-24656 or the next vulnerability affects your stack