CVE-2023-5602

The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.5. This is due to missing or incorrect nonce validation on several functions corresponding to AJAX actions. This makes it possible for unauthenticated attackers to invoke those actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352
• CWE-352

• https://plugins.trac.wordpress.org/changeset/2975574/ultimate-social-media-icons/tags/2.8.6/libs/controllers/sfsi_buttons_controller.php?old=2956446&old_path=ultimate-social-media-icons%2Ftags%2F2.8.5%2Flibs%2Fcontrollers%2Fsfsi_buttons_controller.phpPatch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/d44a45fb-3bff-4a1f-8319-a58a47a9d76b?source=cveProduct, Third Party Advisory
• https://plugins.trac.wordpress.org/changeset/2975574/ultimate-social-media-icons/tags/2.8.6/libs/controllers/sfsi_buttons_controller.php?old=2956446&old_path=ultimate-social-media-icons%2Ftags%2F2.8.5%2Flibs%2Fcontrollers%2Fsfsi_buttons_controller.phpPatch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/d44a45fb-3bff-4a1f-8319-a58a47a9d76b?source=cveProduct, Third Party Advisory

Published

Oct 20, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-5595Denial of Service in GitHub repository gpac/gpac prior to 2.…5.5
• CVE-2023-5597A stored Cross-site Scripting (XSS) vulnerability affecting …5.4
• CVE-2023-5598Stored Cross-site Scripting (XSS) vulnerabilities affecting …5.4
• CVE-2023-5599A stored Cross-site Scripting (XSS) vulnerability affecting …5.4
• CVE-2023-5600An issue has been discovered in GitLab EE affecting all vers…3.1
• CVE-2023-5601The WooCommerce Ninja Forms Product Add-ons WordPress plugin…9.8
• CVE-2023-5604The Asgaros Forum WordPress plugin before 2.7.1 allows forum…9.8
• CVE-2023-5605The URL Shortify WordPress plugin before 1.7.9.1 does not sa…4.8
• CVE-2023-5606The ChatBot for WordPress is vulnerable to Stored Cross-Site…4.8
• CVE-2023-5607 An improper limitation of a path name to a restricted direc…7.2
• CVE-2023-5609The Seraphinite Accelerator WordPress plugin before 2.2.29 d…6.1
• CVE-2023-5610The Seraphinite Accelerator WordPress plugin before 2.2.29 d…5.4