SEGURIDAD DE PLUGINS
Vulnerabilidades conocidas, compatibilidad con PHP y alternativas más seguras para el plugin de WordPress AddToAny Share Buttons — verificado contra la base de datos de seguridad local de WP Clinic.
add-to-anyshareshare buttonsshare iconssocialsocial media
2 CVEs conocidos registrados para AddToAny Share Buttons. Reportadas entre 2017 y 2021.
| CVE | Vulnerabilidad | Tipo | Gravedad | Afectadas | Corregido en | Publicado | Estado |
|---|---|---|---|---|---|---|---|
| CVE-2021-24616 | AddToAny Share Buttons [add-to-any] < 1.7.48 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 4,8 | < 1.7.48 | 1.7.48 | 2021-08-10 | ✓ corregido en la última versión |
| CVE-2021-24568 | AddToAny Share Buttons [add-to-any] < 1.7.46 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 5,4 | < 1.7.46 | 1.7.46 | 2021-08-09 | ✓ corregido en la última versión |
| — | AddToAny Share Buttons [add-to-any] < 1.7.15 | — | Desconocido | < 1.7.15 | 1.7.15 | 2017-08-16 | ✓ corregido en la última versión |
| — | AddToAny Share Buttons [add-to-any] < 1.7.15 | — | Desconocido | < 1.7.15 | 1.7.15 | 2017-08-16 | ✓ corregido en la última versión |
| — | AddToAny Share Buttons [add-to-any] < 1.7.15 | — | Desconocido | < 1.7.15 | 1.7.15 | — | ✓ corregido en la última versión |
The AddToAny Share Buttons WordPress plugin before 1.7.48 does not escape its Image URL button setting, which could lead allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
The AddToAny Share Buttons WordPress plugin before 1.7.46 does not sanitise its Sharing Header setting when outputting it in frontend pages, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
Conditional Host Header Injection vulnerability found by Paul Dannewitz in WordPress AddToAny Share Buttons plugin. Vulnerable plugin version used Host header instead of home_url() thus allows custom Host_header injection by crafted link, web cache poisoning and it may end up with sharing malicious website by all users. Update the WordPress AddToAny Share Buttons plugin to the latest available version (at least 1.7.15).
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Patchstack
The AddToAny Share Buttons plugin for WordPress is vulnerable to Host Header Injections in versions up to, and including, 1.7.14. This is due to a failure to properly validate the HTTP request header. This makes it possible for unauthorized attackers to poison the website cache and log users credentials.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
Plugin description: "AddToAny is the universal sharing platform, and AddToAny’s plugin is the most popular share plugin for WordPress, making sites social media ready since 2006." Active installs (according to https://wordpress.org/plugins/add-to-any/): 400,000+ (checked on 15. Aug 2017) It's possible to inject a custom Host-Header, that will be used for building the link, which is going to be shared on Social Media platforms when users click the buttons. Combined with a web cache poisoning, every user would share the malicious website. README.txt:179-192 To share the current URL and title (detected on the client-side): `<?php if ( function_exists( 'ADDTOANY_SHARE_SAVE_KIT' ) ) { ADDTOANY_SHARE_SAVE_KIT( array( 'use_current_page' => true ) ); } ?>` To hardcode the shared current URL and modify the title (server-side): `<?php if ( function_exists( 'ADDTOANY_SHARE_SAVE_KIT' ) ) { ADDTOANY_SHARE_SAVE_KIT( array( 'linkname' => is_home() ? get_bloginfo( 'description' ) : wp_title( '', false ), 'linkurl' => esc_url_raw( ( is_ssl() ? 'https://' : 'http://' ) . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'] ), ) ); } ?>` Both versions will use the malicious Host-Header as the domain. Following code is part of the function A2A_SHARE_SAVE_link_vars( $linkname = false, $linkurl = false, $linkmedia = false, $use_current_page = false ). add-to-any.php:72-81 // Set linkurl if ( ! $linkurl ) { if ( $use_current_page ) { $linkurl = esc_url_raw ( ( is_ssl() ? 'https://' : 'http://' ) . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'] ); } elseif ( isset( $post ) ) { $linkurl = get_permalink( $post->ID ); } else { $linkurl = ''; } } add-to-any.php:83 $linkurl_enc = rawurlencode( $linkurl ); add-to-any.php:88 return compact( 'linkname', 'linkname_enc', 'linkurl', 'linkurl_enc', 'linkmedia', 'linkmedia_enc' ); Following code is part of the function function ADDTOANY_SHARE_SAVE_KIT( $args = array() ). add-to-any.php:100 $args = array_merge( $args, A2A_SHARE_SAVE_link_vars( $linkname, $linkurl, $linkmedia, $use_current_page ) ); // linkname_enc, etc. add-to-any.php:108 extract( $args ); add-to-any.php:173 $kit_html = ADDTOANY_SHARE_SAVE_ICONS( $args ); Following code is part of the function ADDTOANY_SHARE_SAVE_ICONS( $args = array() ). add-to-any.php:200 $args = array_merge( $args, A2A_SHARE_SAVE_link_vars( $linkname, $linkurl, $linkmedia ) ); // linkname_enc, etc. add-to-any.php:221 extract( $args ); add-to-any.php:339 $url = isset( $href ) ? $href : 'https://www.addtoany.com/add_to/' . $safe_name . '?linkurl=' . $linkurl_enc .'&linkname=' . $linkname_enc; Impact: If the attacker would manage to poison the website cache, he could make the users share his website for fun and profit, include a malicious code on his website and get traffic on it through this or clone the website he is attacking with a squatted domain in order to log the login credentials of users, which don't notice it's not the real website. Timeline: 16. Aug 2017 1:09 AM MESZ - Vendor contacted 16. Aug 2017 3:20 AM MESZ - Vendor answered and fixed it (Version 1.7.15)
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: WPScan
Mantén AddToAny Share Buttons actualizado — 1.8.18 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").
Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.
Ejecuta un escaneo pasivo gratis ahora, o crea una cuenta gratuita e instala el plugin de WP Clinic para un escaneo profundo de toda tu cuenta de hosting y reparación asistida por IA.