CVE-2021-47910: AccessPress Social Icons XSS Vulnerability

CVE-2021-47910 Overview

CVE-2021-47910 is a stored cross-site scripting (XSS) vulnerability in the AccessPress Social Icons WordPress plugin version 1.8.2. The flaw resides in the icon title field, which fails to sanitize user-supplied input before storing it in the database. Authenticated attackers with access to the plugin's administrative interface can inject JavaScript payloads, such as <img src=x onerror=...> constructs. Stored payloads execute in the browser of any user who subsequently views the plugin page. The vulnerability is classified under [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact

Stored JavaScript payloads execute in the context of authenticated WordPress users viewing the plugin page, enabling session theft, administrative action hijacking, and persistent client-side compromise.

Affected Products

• AccessPress Social Icons WordPress plugin version 1.8.2
• WordPress installations with the vulnerable plugin enabled
• AccessPress Themes ecosystem deployments distributing this plugin

Discovery Timeline

• 2026-05-10 - CVE-2021-47910 published to the National Vulnerability Database
• 2026-05-12 - Last updated in NVD database

Technical Details for CVE-2021-47910

Vulnerability Analysis

The vulnerability stems from missing output encoding and input sanitization on the icon title parameter accepted by the AccessPress Social Icons plugin. When an authenticated user with plugin configuration privileges submits a social icon entry, the supplied title is written to persistent storage without HTML-context escaping. The stored value is later rendered directly into the plugin's administrative page markup. Any HTML or JavaScript embedded in that field becomes part of the served DOM and executes in viewing users' browsers.

Because this is a stored XSS rather than reflected, exploitation persists across sessions and affects every user who loads the affected admin view. The attacker only needs to plant the payload once. Subsequent victims need not click a crafted link, only navigate to the plugin interface.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The plugin treats the icon title field as trusted content and emits it into the HTML response without applying functions such as esc_html() or esc_attr() from the WordPress core escaping API. This omission allows arbitrary markup to be rendered as live HTML rather than inert text.

Attack Vector

The attack requires network access to the WordPress admin interface and authenticated privileges sufficient to edit social icon entries. User interaction is needed in the form of an administrator or other privileged user viewing the plugin page after the payload has been planted. A typical payload uses an image tag with an onerror handler, for example a broken image source paired with JavaScript in the error callback. Once the page renders, the injected script runs with the privileges of the viewing user's session, enabling cookie exfiltration, CSRF-style forced actions, or pivoting to other administrative functionality. Refer to the Exploit-DB #50515 entry and the VulnCheck Advisory for AccessPress Plugin for technical details.

Detection Methods for CVE-2021-47910

Indicators of Compromise

• Social icon entries in the WordPress database containing <script>, <img, onerror=, or onload= substrings in the title field
• Unexpected outbound HTTP requests from admin browser sessions to attacker-controlled domains shortly after loading the plugin page
• Creation of new administrator accounts or modification of user roles following admin visits to the social icons configuration page

Detection Strategies

• Query the wp_options and plugin-specific tables for stored values matching HTML tag patterns or JavaScript event handlers in the icon title field
• Inspect web server access logs for POST requests to AccessPress Social Icons admin endpoints containing URL-encoded < or script tokens
• Deploy a Content Security Policy in report-only mode to surface inline script execution on /wp-admin/ pages serving plugin configuration

Monitoring Recommendations

• Enable WordPress audit logging for plugin setting changes and review entries authored by lower-privileged users
• Alert on admin session cookies appearing in outbound traffic to unrecognized destinations
• Monitor for unauthorized changes to user roles, theme files, or wp-config.php following plugin interactions

How to Mitigate CVE-2021-47910

Immediate Actions Required

• Deactivate the AccessPress Social Icons plugin until a patched build is verified and deployed
• Audit all stored social icon titles and purge any entries containing HTML tags or JavaScript event handlers
• Rotate WordPress administrator credentials and invalidate active sessions if exploitation is suspected
• Restrict plugin configuration privileges to a minimal set of trusted accounts

Patch Information

No vendor patch URL is referenced in the available CVE data. Administrators should consult the WordPress Plugin Information page and the AccessPress Themes Site for the latest plugin release and upgrade beyond version 1.8.2 when a fixed build is available.

Workarounds

• Replace AccessPress Social Icons with an alternative, actively maintained social icon plugin
• Deploy a web application firewall rule that blocks HTML tags and JavaScript event handlers in POST parameters targeting the plugin's admin endpoints
• Apply a strict Content Security Policy disallowing inline scripts on WordPress admin pages to reduce payload execution impact
• Limit /wp-admin/ access by source IP using web server or reverse proxy rules until the plugin is removed or updated