Description
The Social Share, Social Login and Social Comments Plugin – Super Socializer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'heateor_mastodon_share' parameter in all versions up to, and including, 7.14.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Published: 2026-07-08
Score: 6.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The plugin accepts the heateor_mastodon_share parameter without proper sanitisation or escaping, allowing attackers to embed arbitrary JavaScript into HTTP responses. When a victim follows a crafted link or submits a form containing a malicious value for this parameter, the script executes in their browser. This reflected Cross‑Site Scripting can be used to steal session cookies, deface content, or redirect users to phishing sites, thereby compromising confidentiality and integrity of the site and its users.

Affected Systems

Any WordPress installation that has the Super Socializer plugin – Social Share, Social Login and Social Comments Plugin – Super Socializer by the_champ with a version of 7.14.5 or earlier is affected. The vulnerability exists in all those releases up to and including 7.14.5.

Risk and Exploitability

The CVSS score of 6.1 indicates a medium severity vulnerability. The EPSS score is less than 1% and the flaw is not listed in the CISA KEV catalog. Exploitation requires no authentication; an attacker merely crafts a URL or link that includes a malicious heateor_mastodon_share value and lures a user to click it. Success depends on social engineering, and the impact is limited to the victim’s browser session.

Generated by OpenCVE AI on July 29, 2026 at 14:45 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Super Socializer plugin to a version newer than 7.14.5, ensuring that the vulnerable heateor_mastodon_share parameter is no longer available.
  • As a temporary measure, configure the web server or application firewall to block or ignore any HTTP requests that contain the heateor_mastodon_share parameter, preventing the reflected payload from reaching the browser.
  • Deploy a robust Content Security Policy that restricts script execution to trusted domains, which mitigates the risk that a malicious payload will run even if the user encounters a crafted URL.

Generated by OpenCVE AI on July 29, 2026 at 14:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 10 Jul 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared The Champ
The Champ social Share, Social Login And Social Comments Plugin – Super Socializer
Wordpress
Wordpress wordpress
Vendors & Products The Champ
The Champ social Share, Social Login And Social Comments Plugin – Super Socializer
Wordpress
Wordpress wordpress

Wed, 08 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 08 Jul 2026 05:45:00 +0000

Type Values Removed Values Added
Description The Social Share, Social Login and Social Comments Plugin – Super Socializer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'heateor_mastodon_share' parameter in all versions up to, and including, 7.14.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Title Social Share, Social Login and Social Comments Plugin <= 7.14.5 - Reflected Cross-Site Scripting via 'heateor_mastodon_share' Parameter
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

Subscriptions

The Champ Social Share, Social Login And Social Comments Plugin – Super Socializer
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-07-08T15:06:40.488Z

Reserved: 2026-06-09T13:39:24.046Z

Link: CVE-2026-11798

cve-icon Vulnrichment

Updated: 2026-07-08T15:06:37.705Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-29T15:00:04Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')