¿Es seguro Social Icons Widget By Wpzoom?

Qué hace este plugin

• Slug: social-icons-widget-by-wpzoom
• 90000+ instalaciones activas

click to chatshare buttonssocial iconssocial sharingwhatsapp

Estado de mantenimiento

• Última versión conocida: 4.6.0
• Requiere PHP: 7.4+
• PHP máximo soportado (analizado): 8.4

Vulnerabilidades conocidas

3 CVEs conocidos registrados para Social Icons Widget By Wpzoom.

CVE-2024-2189

The Social Icons Widget & Block by WPZOOM plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.2.17 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-30464

Update the WordPress Social Icons Widget & Block by WPZOOM plugin to the latest available version (at least 4.2.16). Rafie Muhammad (Patchstack) discovered and reported this Broken Access Control vulnerability in WordPress Social Icons Widget & Block by WPZOOM Plugin. A broken access control issue refers to a missing authorization, authentication or nonce token check in a function that could lead to an unprivileged user to executing a certain higher privileged action. This vulnerability has been fixed in version 4.2.16. This vulnerability was reported to and published by Patchstack. Our users receive alerts and protections up to 48 hours in advance. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2026-4063

The Social Icons Widget & Block by WPZOOM plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check in the add_menu_item() method hooked to admin_menu in all versions up to, and including, 4.5.8. This is due to the method performing wp_insert_post() and update_post_meta() calls to create a sharing configuration without verifying the current user has administrator-level capabilities. This makes it possible for authenticated attackers, with Subscriber-level access and above, to trigger the creation of a published wpzoom-sharing configuration post with default sharing button settings, which causes social sharing buttons to be automatically injected into all post content on the frontend via the the_content filter.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Cómo solucionarlo

Mantén Social Icons Widget By Wpzoom actualizado — 4.6.0 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.

Alternativas más seguras / más establecidas

• Joinchat – Enhanced "click to chat" — 700000+ instalaciones activas — 94/100 (189) — PHP máx. 8.4
• Click to Chat – HoliThemes — 700000+ instalaciones activas — 96/100 (131) — PHP máx. 8.4
• AddToAny Share Buttons — 300000+ instalaciones activas — 94/100 (1113)
• Social Chat – Click To Chat App Button — 200000+ instalaciones activas — 98/100 (685) — PHP máx. 8.4
• WP Chat App — 100000+ instalaciones activas — 98/100 (218)