¿Es seguro Ultimate Social Media Icons?

Qué hace este plugin

• Slug: ultimate-social-media-icons
• 100000+ instalaciones activas

shareshare iconssocialsocial mediawidget

Estado de mantenimiento

• Última versión conocida: 2.9.9
• PHP máximo soportado (analizado): 8.4

Vulnerabilidades conocidas

12 CVEs conocidos registrados para Ultimate Social Media Icons. Reportadas entre 2015 y 2024.

CVE-2023-38514

Missing Authorization vulnerability in social share pro Social Share Icons & Social Share Buttons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Social Share Icons & Social Share Buttons: from n/a through 3.5.7.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-10362

The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-37552

The Social Media & Share Icons plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only impacts multi-site installations and installations where unfiltered_html has been disabled.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-31435

<p>WordPress Social Media & Share Icons Plugin <= 2.8.6 is vulnerable to Broken Access Control</p><p>Software: Social Media & Share Icons</p><p>Link: https://wordpress.org/plugins/ultimate-social-media-icons/#developers</p><p>Affected Version <= 2.8.6</p><p>Fixed in version 2.8.7 </p>

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2024-2118

The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.8.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2023-5070

The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.8.5 via the sfsi_save_export function. This can allow subscribers to export plugin settings that include social media authentication tokens and secrets as well as app passwords.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2023-5602

The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.5. This is due to missing or incorrect nonce validation on several functions corresponding to AJAX actions. This makes it possible for unauthenticated attackers to invoke those actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2023-41238

Update the WordPress Social Media & Share Icons plugin to the latest available version (at least 2.8.4). FearZzZz discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Social Media & Share Icons Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 2.8.4.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

+ 12 vulnerabilidades conocidas más

CVE	Vulnerabilidad	Tipo	Gravedad	Afectadas	Corregido en	Publicado	Estado
CVE-2023-0958	Social Media Share Buttons & Social Sharing Icons [ultimate-social-media-icons] < 2.8.2	Falta de control de autorización	Media 6,5	< 2.8.2	2.8.2	2023-07-27	✓ corregido en la última versión
CVE-2023-3977	Social Media Share Buttons & Social Sharing Icons [ultimate-social-media-icons] < 2.8.2	Falsificación de petición en sitios cruzados (CSRF)	Media 4,3	< 2.8.2	2.8.2	2023-07-27	✓ corregido en la última versión
CVE-2023-1166	Social Media Share Buttons & Social Sharing Icons [ultimate-social-media-icons] < 2.8.2	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 4,8	< 2.8.2	2.8.2	2023-06-05	✓ corregido en la última versión
CVE-2023-34009	Social Media Share Buttons & Social Sharing Icons [ultimate-social-media-icons] < 2.8.2	Falta de control de autorización	Media 4,3	< 2.8.2	2.8.2	2023-06-02	✓ corregido en la última versión
—	Social Media Share Buttons & Social Sharing Icons [ultimate-social-media-icons] < 1.1.1.12	—	Desconocido	< 1.1.1.12	1.1.1.12	2023-05-30	✓ corregido en la última versión
—	Social Media Share Buttons & Social Sharing Icons [ultimate-social-media-icons] < 2.1.9	—	Desconocido	< 2.1.9	2.1.9	2019-03-27	✓ corregido en la última versión
—	Social Media Share Buttons & Social Sharing Icons [ultimate-social-media-icons] < 1.5.2	—	Desconocido	< 1.5.2	1.5.2	2016-06-28	✓ corregido en la última versión
—	Social Media Share Buttons & Social Sharing Icons [ultimate-social-media-icons] < 1.2.2	—	Desconocido	< 1.2.2	1.2.2	2015-07-20	✓ corregido en la última versión
—	Social Media Share Buttons & Social Sharing Icons [ultimate-social-media-icons] < 1.1.1.12	—	Desconocido	< 1.1.1.12	1.1.1.12	2015-05-30	✓ corregido en la última versión
—	Social Media Share Buttons & Social Sharing Icons [ultimate-social-media-icons] < 1.1.1.12	—	Desconocido	< 1.1.1.12	1.1.1.12	2015-05-30	✓ corregido en la última versión
—	Social Media Share Buttons & Social Sharing Icons [ultimate-social-media-icons] < 2.2.0	—	Desconocido	< 2.2.0	2.2.0	—	✓ corregido en la última versión
—	Social Media Share Buttons & Social Sharing Icons [ultimate-social-media-icons] < 1.1.1.12	—	Desconocido	< 1.1.1.12	1.1.1.12	—	✓ corregido en la última versión

CVE-2023-0958

Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for authenticated attackers with minimal permissions, such as subscribers, to install select plugins from Inisev on vulnerable sites. CVE-2023-38514 appears to be a duplicate of this vulnerability.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2023-3977

Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plugins due to a missing nonce check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for unauthenticated attackers to install plugins from the limited list via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2023-1166

The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 2.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2023-34009

The Social Media & Share Icons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handle_installation function in versions up to, and including, 2.8.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to install one of a pre-defined set of plugins.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Social Media Share Buttons & Social Sharing Icons [ultimate-social-media-icons] < 1.1.1.12

Update the plugin. An unknown person discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Social Media & Share Icons Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 1.1.1.12.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Social Media Share Buttons & Social Sharing Icons [ultimate-social-media-icons] < 2.1.9

The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the wp_ajax_getForm AJAX action in versions up to, and including, 2.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Social Media Share Buttons & Social Sharing Icons [ultimate-social-media-icons] < 1.5.2

The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Arbitrary Options Deletion in versions up to, and including, 1.5.1. This is due to missing capability checks on the sfsi_DeleteSkin() function that deletes options based on a user supplied parameter. This makes it possible for authenticated attackers with subscriber level and above permissions to delete arbitrary site options which can cause a loss of data and functionality on an affected WordPress site.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Social Media Share Buttons & Social Sharing Icons [ultimate-social-media-icons] < 1.2.2

The Social Media Share Buttons & Social Sharing Icons plugin for WordPress patched unspecified vulnerabilities in version 1.2.2.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Social Media Share Buttons & Social Sharing Icons [ultimate-social-media-icons] < 1.1.1.12

Because of this vulnerability, the attackers can inject arbitrary web script or HTML. Update the plugin.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Social Media Share Buttons & Social Sharing Icons [ultimate-social-media-icons] < 1.1.1.12

The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in versions before 1.1.1.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers of low-privilege to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Social Media Share Buttons & Social Sharing Icons [ultimate-social-media-icons] < 2.2.0

The Social Media Share Buttons & Social Sharing Icons WordPress plugin was affected by a Multiple Issues security vulnerability.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Social Media Share Buttons & Social Sharing Icons [ultimate-social-media-icons] < 1.1.1.12

The Social Media Share Buttons & Social Sharing Icons WordPress plugin was affected by an Authenticated Stored Cross-Site Scripting (XSS) security vulnerability.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Cómo solucionarlo

Mantén Ultimate Social Media Icons actualizado — 2.9.9 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.

Alternativas más seguras / más establecidas

• AddToAny Share Buttons — 300000+ instalaciones activas — 94/100 (1113)
• Ocean Social Sharing — 60000+ instalaciones activas — 90/100 (11) — PHP máx. 8.4
• Buttonizer – Social Media Share Buttons, Social Icons, & Social Feeds — 40000+ instalaciones activas — 96/100 (395) — PHP máx. 8.4
• Simple Share Buttons Adder — 40000+ instalaciones activas — 86/100 (626)
• Genesis Simple Share — 10000+ instalaciones activas — 88/100 (33)