Vulnerabilities

TI-2024-08999 CVE-2024-9702 · GHSA-hggj-xw9j-66ph

Social Rocket <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

LOW 28

The Social Rocket – Social Sharing Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'socialrocket-floating' shortcode in all versions up to, and including, 1.3.4 due to insufficie…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.0032 Published 2025-01-07 No fix listed CWE-79

TI-2024-08994 CVE-2024-9697 · GHSA-p9mp-q42m-g65q

Social Rocket – Social Sharing Plugin <= 1.3.4 - Missing Authorization to Settings Update

LOW 30

The Social Rocket – Social Sharing Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tweet_settings_save() and tweet_settings_update() functions in al…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00397 Published 2025-01-07 No fix listed CWE-862

TI-2024-24773 CVE-2024-37258 · GHSA-9q6h-c75x-2rqw

WordPress Social Rocket plugin <= 1.3.3 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Social Rocket allows Reflected XSS.This issue affects Social Rocket: from n/a through 1.3.3.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00308 Published 2024-07-22 No fix listed CWE-79

TI-2022-02895 CVE-2022-3136 · GHSA-w38f-gqg6-3mx7

Social Rocket < 1.3.3 - Admin+ Stored Cross-Site Scripting

LOW 23

The Social Rocket WordPress plugin before 1.3.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilte…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00602 Published 2022-10-10 Fixed in 1.3.3 CWE-79

TI-2020-04580 CVE-2020-5611 · GHSA-ggvm-cfcf-j5g6

Cross-site request forgery in socialrocket Social Sharing Plugin

MEDIUM 40

Cross-site request forgery (CSRF) vulnerability in Social Sharing Plugin versions prior to 1.2.10 allows remote attackers to hijack the authentication of administrators via unspecified vectors.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01163 Published 2020-07-27 Fixed in 1.2.10 CWE-352