CVE-2021-36843 : Security Advisory and Response

WordPress Floating Social Media Icon plugin (versions <= 4.3.5) has been identified with an Authenticated Stored Cross-Site Scripting (XSS) vulnerability, affecting high role users like admin.

Understanding CVE-2021-36843

This CVE discloses a security flaw in the WordPress Floating Social Media Icon plugin, allowing attackers to execute malicious scripts in the Social Media Configuration form.

What is CVE-2021-36843?

The CVE-2021-36843 is an Authenticated Stored Cross-Site Scripting (XSS) vulnerability found in versions <= 4.3.5 of the WordPress Floating Social Media Icon plugin.

The Impact of CVE-2021-36843

The vulnerability poses a medium severity threat with a CVSS base score of 4.8, requiring a high-level user role such as admin for exploitation.

Technical Details of CVE-2021-36843

This section covers specific technical details of the CVE.

Vulnerability Description

The vulnerability allows authenticated attackers to inject malicious scripts in the Social Media Configuration form, leading to potential XSS attacks.

Affected Systems and Versions

The affected product is the Floating Social Media Icon WordPress plugin by Acurax Technologies, with versions <= 4.3.5.

Exploitation Mechanism

An attacker with high privileges, like an admin, can exploit this vulnerability by injecting malicious scripts through the Social Media Configuration form.

Mitigation and Prevention

Following are the essential steps to mitigate and prevent exploitation of CVE-2021-36843.

Immediate Steps to Take

Immediately update the Floating Social Media Icon plugin to a secure version beyond 4.3.5.
Restrict user access to minimize the reliance on high-level roles like admin.

Long-Term Security Practices

Regularly monitor and update all WordPress plugins to safeguard against known vulnerabilities.
Educate users with high roles about safe practices to prevent XSS vulnerabilities.

Patching and Updates

Stay informed about security updates released by Acurax Technologies for the Floating Social Media Icon plugin to patch the vulnerability effectively.