Description

Unauthenticated Cross Site Scripting (XSS) in Super Socializer <= 7.14.5 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-06T15:17:16.233Z",
  "pubdate": "2026-08-06T15:17:16.233Z",
  "executiveSummary": "An unauthenticated Cross-Site Scripting (XSS) vulnerability has been identified in the Super Socializer plugin, specifically affecting versions 7.14.5 and prior. This security flaw enables remote attackers to inject malicious client-side scripts, typically JavaScript, into web pages rendered to legitimate site visitors. The root cause stems from insufficient input sanitization and inadequate output encoding of user-supplied data processed by the plugin. Because exploitation requires no prior authentication or administrative privileges, unauthenticated malicious actors can target web applications over the network. The potential impact of this vulnerability includes the execution of arbitrary script code in the context of a victim's browser session, session hijacking, credential theft, and unauthorized manipulation of the Document Object Model (DOM) of the affected WordPress site. Successful exploitation relies on tricking a user into interacting with a specially crafted URL or leveraging automated delivery vectors to execute the payload upon page load. Mitigating this risk requires immediate vendor patching or disabling the affected plugin features until an upgraded version addressing the sanitization bypass is installed.",
  "technicalDetails": "The vulnerability is an instance of Unauthenticated Cross-Site Scripting (XSS) residing within the Super Socializer plugin for WordPress, impacting versions <= 7.14.5. The root cause of the issue is the failure of the application logic to properly sanitize, validate, or encode untrusted HTTP request parameters before reflecting them within the Document Object Model (DOM) or returning them in HTTP responses. Because the affected functionality handles requests without requiring authentication, the attack surface is exposed externally over the network to any unauthenticated user.\nThe attack flow proceeds as follows: 1) An attacker crafts a malicious URL containing a payload comprising executable JavaScript code injected into vulnerable input vectors handled by the Super Socializer plugin. 2) The attacker induces a targeted user or administrator to click the malicious link or automatically loads the resource via malicious redirects, iframes, or cross-site request vectors. 3) The target browser sends an HTTP request to the vulnerable WordPress instance hosting the Super Socializer plugin. 4) The plugin processes the malicious input and reflects it back in the HTTP response without proper HTML entity encoding or context-aware sanitization. 5) The victim's browser parses the HTTP response, interprets the reflected input as executable markup, and executes the arbitrary script within the context of the victim's active session.\nPost-exploitation impact includes the ability for the injected script to access document.cookie, execute unauthorized actions on behalf of the authenticated user, perform keylogging, or redirect the user to malicious external phishing portals. The vulnerability requires zero privileges and no authentication, making network-based exploitation straightforward for external threat actors targeting exposed endpoints."
}