🦸 💥 Calling all superheroes and hunters! Introducing the End of Year Holiday Extravaganza and the WordPress Superhero Challenge for the Wordfence Bug Bounty Program

Through December 9th, 2024, all in-scope vulnerability types for WordPress plugins/themes with >= 1,000 Active Installations are in-scope for ALL researchers, all plugins and themes that are hosted in the WordPress.org repository with at least 50 active installs that have been updated in the last 2 years will be in-scope for ALL researchers, the minimum bounty awarded for all in-scope submissions will be $5, and ALL researchers earn automatic bonuses of 5%-180% for valid submissions in software with 1,000 - 4,999,999 active installs, pending report limits are increased for all, and it's possible to earn up to $31,200 for high impact vulnerabilities!

Review what's in scope for your tier and updated bounties with bonuses here!

Social Media Share Buttons & Social Sharing Icons

Wordfence Intelligence > Vulnerability Database > WordPress Plugins > Social Media Share Buttons & Social Sharing Icons

Information

Software Type	Plugin
Software Slug	ultimate-social-media-icons (view on wordpress.org)
Software Status	Active
Software Author	inisev
Software Website	ultimatelysocial.com
Software Downloads	11,651,803
Software Active Installs	100,000
Software Record Last Updated	November 21, 2024

13 Vulnerabilities

Submit a Vulnerability

Social Media & Share Icons <= 2.9.1 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVE-2024-37552

Jul 6, 2024

Researcher: Joshua Chan

Social Media Share Buttons <= 2.8.8 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVE-2024-2118

Mar 27, 2024

Researcher: Dmitrii Ignatyev

Social Media Share Buttons & Social Sharing Icons <= 2.8.5 - Information Exposure

6.5

CVE-2023-5070

Oct 16, 2023

Researcher: Marco Wotschka

Social Media Share Buttons & Social Sharing Icons <= 2.8.5 - Cross-Site Request Forgery

4.3

CVE-2023-5602

Oct 16, 2023

Researcher: Marco Wotschka

Social Media & Share Icons <= 2.8.3 - Reflected Cross-Site Scripting

6.1

CVE-2023-41238

Aug 29, 2023

Researcher: RE-ALTER

Inisev Plugins (Various Versions) - Cross-Site Request Forgery on handle_installation function

4.3

CVE-2023-3977

Jul 27, 2023

Researcher: Chloe Chamberland

Inisev Plugins (Various Versions) - Missing Authorization on handle_installation function

4.3

CVE-2023-0958

Jul 27, 2023

Researcher: Chloe Chamberland

Social Media Share Buttons & Social Sharing Icons <= 2.8.1 - Authenticated(Administrator+) Stored Cross-Site Scripting

4.4

CVE-2023-1166

Jun 5, 2023

Researcher: Mohamed Selim

Social Media & Share Icons <= 2.8.1 - Missing Authorization via handle_installation

4.3

CVE-2023-34009

Jun 2, 2023

Researcher: István Márton

Social Media Share Buttons & Social Sharing Icons <= 2.1.7 - Reflected Cross-Site Scripting

6.1

CVE ID Unknown

Mar 27, 2019

Researchers:

Social Media Share Buttons & Social Sharing Icons <= 1.5.1 - Arbitrary Options Deletion

5.4

CVE ID Unknown

Jun 28, 2016

Researchers:

Social Media Share Buttons & Social Sharing Icons <= 1.2.1 - Unspecified Vulnerabilities

7.3

CVE ID Unknown

Jul 20, 2015

Researchers:

Social Media Share Buttons & Social Sharing Icons < 1.1.1.12 - Authenticated Stored Cross-Site Scripting

6.4

CVE ID Unknown

May 30, 2015

Researcher: James Hooker

Title	Status	CVE ID	CVSS	Researchers	Date
Social Media & Share Icons <= 2.9.1 - Authenticated (Administrator+) Stored Cross-Site Scripting	Patched	CVE-2024-37552	4.4	Joshua Chan	July 6, 2024
Social Media Share Buttons <= 2.8.8 - Authenticated (Administrator+) Stored Cross-Site Scripting	Patched	CVE-2024-2118	4.4	Dmitrii Ignatyev	March 27, 2024
Social Media Share Buttons & Social Sharing Icons <= 2.8.5 - Information Exposure	Patched	CVE-2023-5070	6.5	Marco Wotschka	October 16, 2023
Social Media Share Buttons & Social Sharing Icons <= 2.8.5 - Cross-Site Request Forgery	Patched	CVE-2023-5602	4.3	Marco Wotschka	October 16, 2023
Social Media & Share Icons <= 2.8.3 - Reflected Cross-Site Scripting	Patched	CVE-2023-41238	6.1	RE-ALTER	August 29, 2023
Inisev Plugins (Various Versions) - Cross-Site Request Forgery on handle_installation function	Patched	CVE-2023-3977	4.3	Chloe Chamberland	July 27, 2023
Inisev Plugins (Various Versions) - Missing Authorization on handle_installation function	Patched	CVE-2023-0958	4.3	Chloe Chamberland	July 27, 2023
Social Media Share Buttons & Social Sharing Icons <= 2.8.1 - Authenticated(Administrator+) Stored Cross-Site Scripting	Patched	CVE-2023-1166	4.4	Mohamed Selim	June 5, 2023
Social Media & Share Icons <= 2.8.1 - Missing Authorization via handle_installation	Patched	CVE-2023-34009	4.3	István Márton	June 2, 2023
Social Media Share Buttons & Social Sharing Icons <= 2.1.7 - Reflected Cross-Site Scripting	Patched		6.1		March 27, 2019
Social Media Share Buttons & Social Sharing Icons <= 1.5.1 - Arbitrary Options Deletion	Patched		5.4		June 28, 2016
Social Media Share Buttons & Social Sharing Icons <= 1.2.1 - Unspecified Vulnerabilities	Patched		7.3		July 20, 2015
Social Media Share Buttons & Social Sharing Icons < 1.1.1.12 - Authenticated Stored Cross-Site Scripting	Patched		6.4	James Hooker	May 30, 2015

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation