vulnerability

WordPress Plugin: super-socializer: CVE-2021-24987: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:M/Au:N/C:N/I:P/A:N)

Published

Mar 15, 2022

Added

May 15, 2025

Modified

Apr 29, 2026

Description

The Social Share, Social Login and Social Comments Plugin WordPress plugin before 7.13.30 does not sanitise and escape the urls parameter in its the_champ_sharing_count AJAX action (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue.

Solution

super-socializer-plugin-cve-2021-24987

References

https://www.cve.org/CVERecord?id=CVE-2021-24987
https://www.wordfence.com/threat-intel/vulnerabilities/id/4fd4d30b-f37f-4083-acfe-8e85c075da10?source=api-prod
https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-11899
CVE-2021-24987
https://attackerkb.com/topics/CVE-2021-24987
CWE-79
EUVD-EUVD-2021-11899

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report