High severity · published Oct 20, 2023
CVE-2023-5602
Social Media Share Buttons & Social Sharing Icons <= 2.8.5 - Cross-Site Request Forgery
8.8
CVSS
0.3%
EPSS
No
On KEV
Description
The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.5. This is due to missing or incorrect nonce validation on several functions corresponding to AJAX actions. This makes it possible for unauthenticated attackers to invoke those actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SM
Social Media Share Buttons & Social Sharing Icons · inisev
through 2.8.5 · source: vendor, NVD
Affected product
SM
Social Media Share Buttons & Social Sharing Icons
inisev
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-5602
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-5602
Patch
https://plugins.trac.wordpress.org/changeset/2975574/ultimate-social-media-icons/tags/2.8.6/libs/controllers/sfsi_buttons_controller.php?old=2956446&old_path=ultimate-social-media-icons%2Ftags%2F2.8.5%2Flibs%2Fcontrollers%2Fsfsi_buttons_controller.php
Product
https://www.wordfence.com/threat-intel/vulnerabilities/id/d44a45fb-3bff-4a1f-8319-a58a47a9d76b?source=cve
More from Social Media Share Buttons & Social Sharing Icons
6.5
CVE-2023-5070
Social Media Share Buttons & Social Sharing Icons <= 2.8.5 - Information Exposure
6.5
CVE-2023-0958
Inisev Plugins (Various Versions) - Missing Authorization on handle_installation function
6.1
CVE-2026-89047
Social Media Share Buttons & Social Sharing Icons <= 3.0.1 - Reflected DOM-Based Cross-Site Scripting via URL
5.9
CVE-2024-2118
Social Media Share Buttons < 2.8.9 - Admin+ Stored XSS via settings
5.4
CVE-2024-37552
WordPress Social Media Share Buttons & Social Sharing Icons plugin <= 2.9.1 - Cross Site Scripting (XSS) vulnerability