WordPress Simple Share Buttons Adder Plugin Multiple Security Vulnerabilities

Bugtraq ID:	68206
Class:	Input Validation Error
CVE:	CVE-2014-4717
Remote:	Yes
Local:	No
Published:	Jun 25 2014 12:00AM
Updated:	Jul 08 2014 12:15AM
Credit:	Duncan Stuart
Vulnerable:
Not Vulnerable:

WordPress Simple Share Buttons Adder Plugin Multiple Security Vulnerabilities

Simple Share Buttons Adder plugin for WordPress is prone to a cross-site request-forgery vulnerability and multiple HTML-injection vulnerabilities.

Exploiting these issues may allow a remote attacker to perform certain unauthorized actions, execute arbitrary script or HTML code within the context of the browser, and steal cookie-based authentication credentials. Other attacks are also possible.

Simple Share Buttons Adder 4.4 is vulnerable.

WordPress Simple Share Buttons Adder Plugin Multiple Security Vulnerabilities

An attacker can exploit HTML-injection issues through a browser.

To exploit the cross-site request-forgery issue, the attacker must entice an unsuspecting victim into visiting a malicious site.

WordPress Simple Share Buttons Adder Plugin Multiple Security Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

WordPress Simple Share Buttons Adder Plugin Multiple Security Vulnerabilities

References: