A Leader in the 2026 Gartner® Magic Quadrant™ for Endpoint Protection. Six years running.Six years. Gartner® Magic Quadrant™ Leader.Find Out Why
Experiencing a Breach?Blog
Get StartedContact Us
SentinelOne
  • Platform
    Platform Overview
    • Singularity Platform
      Welcome to Integrated Enterprise Security
    • AI for Security
      Leading the Way in AI-Powered Security Solutions
    • Securing AI
      Accelerate AI Adoption with Secure AI Tools, Apps, and Agents.
    • How It Works
      The Singularity XDR Difference
    • Singularity Marketplace
      One-Click Integrations to Unlock the Power of XDR
    • Pricing & Packaging
      Comparisons and Guidance at a Glance
    Data & AI
    • Purple AI
      Accelerate SecOps with Generative AI
    • Singularity Hyperautomation
      Easily Automate Security Processes
    • AI-SIEM
      The AI SIEM for the Autonomous SOC
    • AI Data Pipelines
      Security Data Pipeline for AI SIEM and Data Optimization
    • Singularity Data Lake
      AI-Powered, Unified Data Lake
    • Singularity Data Lake for Log Analytics
      Seamlessly Ingest Data from On-Prem, Cloud or Hybrid Environments
    Endpoint Security
    • Singularity Endpoint
      Autonomous Prevention, Detection, and Response
    • Singularity XDR
      Native & Open Protection, Detection, and Response
    • Singularity RemoteOps Forensics
      Orchestrate Forensics at Scale
    • Singularity Threat Intelligence
      Comprehensive Adversary Intelligence
    • Singularity Vulnerability Management
      Application & OS Vulnerability Management
    • Singularity Identity
      Identity Threat Detection and Response
    Cloud Security
    • Singularity Cloud Security
      Block Attacks with an AI-Powered CNAPP
    • Singularity Cloud Native Security
      Secure Cloud and Development Resources
    • Singularity Cloud Workload Security
      Real-Time Cloud Workload Protection Platform
    • Singularity Cloud Data Security
      AI-Powered Threat Detection for Cloud Storage
    • Singularity Cloud Security Posture Management
      Detect and Remediate Cloud Misconfigurations
    Securing AI
    • Prompt Security
      Secure AI Tools Across Your Enterprise
  • Why SentinelOne?
    Why SentinelOne?
    • Why SentinelOne?
      Cybersecurity Built for What’s Next
    • Our Customers
      Trusted by the World’s Leading Enterprises
    • Industry Recognition
      Tested and Proven by the Experts
    • About Us
      The Industry Leader in Autonomous Cybersecurity
    Compare SentinelOne
    • Arctic Wolf
    • Broadcom
    • CrowdStrike
    • Cybereason
    • Microsoft
    • Palo Alto Networks
    • Sophos
    • Splunk
    • Trellix
    • Trend Micro
    • Wiz
    Verticals
    • Energy
    • Federal Government
    • Finance
    • Healthcare
    • Higher Education
    • K-12 Education
    • Manufacturing
    • Retail
    • State and Local Government
  • Services
    Managed Services
    • Managed Services Overview
      Wayfinder Threat Detection & Response
    • Threat Hunting
      World-Class Expertise and Threat Intelligence
    • Managed Detection & Response
      24/7/365 Expert MDR Across Your Entire Environment
    • Incident Readiness & Response
      DFIR, Breach Readiness, & Compromise Assessments
    Support, Deployment, & Health
    • Technical Account Management
      Customer Success with Personalized Service
    • SentinelOne GO
      Guided Onboarding & Deployment Advisory
    • SentinelOne University
      Live and On-Demand Training
    • Services Overview
      Comprehensive Solutions for Seamless Security Operations
    • SentinelOne Community
      Community Login
  • Partners
    Our Network
    • MSSP Partners
      Succeed Faster with SentinelOne
    • Singularity Marketplace
      Extend the Power of S1 Technology
    • Cyber Risk Partners
      Enlist Pro Response and Advisory Teams
    • Technology Alliances
      Integrated, Enterprise-Scale Solutions
    • SentinelOne for AWS
      Hosted in AWS Regions Around the World
    • Channel Partners
      Deliver the Right Solutions, Together
    • SentinelOne for Google Cloud
      Unified, Autonomous Security Giving Defenders the Advantage at Global Scale
    • Partner Locator
      Your Go-to Source for Our Top Partners in Your Region
    Partner Portal→
  • Resources
    Resource Center
    • Case Studies
    • Data Sheets
    • eBooks
    • Reports
    • Videos
    • Webinars
    • Whitepapers
    • Events
    View All Resources→
    Blog
    • Feature Spotlight
    • For CISO/CIO
    • From the Front Lines
    • Identity
    • Cloud
    • macOS
    • SentinelOne Blog
    Blog→
    Tech Resources
    • SentinelLABS
    • Ransomware Anthology
    • Cybersecurity 101
  • About
    About SentinelOne
    • About SentinelOne
      The Industry Leader in Cybersecurity
    • Investor Relations
      Financial Information & Events
    • SentinelLABS
      Threat Research for the Modern Threat Hunter
    • Careers
      The Latest Job Opportunities
    • Press & News
      Company Announcements
    • Cybersecurity Blog
      The Latest Cybersecurity Threats, News, & More
    • FAQ
      Get Answers to Our Most Frequently Asked Questions
    • DataSet
      The Live Data Platform
    • S Foundation
      Securing a Safer Future for All
    • S Ventures
      Investing in the Next Generation of Security, Data and AI
  • Pricing
Get StartedContact Us
CVE Vulnerability Database
Vulnerability Database/CVE-2024-53723

CVE-2024-53723: Google Plus Share Plugin CSRF Vulnerability

CVE-2024-53723 is a Cross-Site Request Forgery vulnerability in Google Plus Share and +1 Button plugin that enables Stored XSS attacks. This article covers the technical details, affected versions up to 1.0, and mitigation.

Published: June 2, 2026

CVE-2024-53723 Overview

CVE-2024-53723 is a Cross-Site Request Forgery (CSRF) vulnerability in the Google Plus Share and +1 Button WordPress plugin by acbaltaci. The flaw chains into Stored Cross-Site Scripting (XSS), allowing attackers to persist malicious scripts in plugin settings. The vulnerability affects all plugin versions up to and including 1.0. Exploitation requires an authenticated administrator to visit an attacker-controlled page. Successful attacks inject JavaScript that executes in the browsers of site visitors and administrators.

Critical Impact

An attacker who tricks a logged-in administrator into loading a malicious page can persistently inject JavaScript into the WordPress site, enabling session theft, account takeover, and visitor compromise.

Affected Products

  • acbaltaci Google Plus Share and +1 Button plugin for WordPress
  • All versions from n/a through 1.0
  • WordPress sites with the google-plus-share-and-plusone-button plugin activated

Discovery Timeline

  • 2024-12-02 - CVE-2024-53723 published to NVD
  • 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2024-53723

Vulnerability Analysis

The vulnerability combines two weaknesses into a single exploitation chain. The plugin's settings handler does not validate request origin, accepting state-changing POST requests without a CSRF token (CWE-352). The same handler stores submitted values without sanitizing or encoding script content before rendering them back in the admin interface or front-end output.

An attacker hosts a page containing a forged form that targets the plugin's settings endpoint. When an authenticated administrator visits that page, the browser silently submits the request using the admin's session cookies. The injected payload is written to the WordPress options table and later rendered without escaping, producing Stored XSS.

Because script execution occurs in the administrator's authenticated context, the attacker can create new admin accounts, modify plugin or theme files, and pivot to remote code execution through WordPress's built-in editors.

Root Cause

The root cause is missing CSRF protection on plugin configuration endpoints. The plugin does not call WordPress functions such as wp_nonce_field() and check_admin_referer() to bind requests to a verified user session. Combined with absent output encoding, attacker-controlled input flows directly from request parameters into rendered HTML.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker delivers a phishing link, malicious advertisement, or compromised site containing a hidden form that auto-submits to the target WordPress instance. The administrator's browser supplies authentication cookies, and the malicious payload is persisted. Subsequent page loads execute the stored JavaScript for any user rendering the affected output.

No public proof-of-concept exploit is listed for CVE-2024-53723. Technical details are available in the Patchstack WordPress Vulnerability Advisory.

Detection Methods for CVE-2024-53723

Indicators of Compromise

  • Unexpected <script> tags, event handlers, or external script references stored in WordPress wp_options rows belonging to the google-plus-share-and-plusone-button plugin
  • New WordPress administrator accounts created without a corresponding audit log entry from a known admin session
  • Outbound requests from visitor browsers to unfamiliar domains originating from pages that embed the plugin's share button

Detection Strategies

  • Audit plugin settings in the database for HTML or JavaScript content where only plain text values are expected
  • Review web server access logs for POST requests to plugin admin endpoints lacking an internal Referer header pointing to /wp-admin/
  • Scan rendered HTML output for inline scripts in regions controlled by plugin options

Monitoring Recommendations

  • Enable WordPress audit logging to capture changes to plugin options, user roles, and administrator account creation
  • Deploy a Web Application Firewall rule that blocks requests to plugin settings endpoints when Origin or Referer headers are absent or external
  • Alert on administrator sessions that perform configuration changes immediately after navigating from external referrers

How to Mitigate CVE-2024-53723

Immediate Actions Required

  • Deactivate and remove the Google Plus Share and +1 Button plugin until a patched release is published
  • Rotate WordPress administrator passwords and invalidate active sessions if the plugin was active on an internet-facing site
  • Inspect plugin option values in the database and remove any unexpected HTML or JavaScript content

Patch Information

No fixed version is identified in the available advisory. The vulnerability affects all versions up to and including 1.0, and the plugin appears to have no patched release. Replace the plugin with an actively maintained sharing solution. Monitor the Patchstack advisory for updates.

Workarounds

  • Restrict access to /wp-admin/ by IP allowlist to reduce CSRF exposure for administrator accounts
  • Enforce a strict Content Security Policy that disallows inline script execution on WordPress front-end pages
  • Require administrators to use a dedicated browser profile for WordPress management to limit cross-site cookie exposure
bash
# Configuration example: deactivate the affected plugin via WP-CLI
wp plugin deactivate google-plus-share-and-plusone-button
wp plugin delete google-plus-share-and-plusone-button

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

  • Vulnerability Details
  • TypeCSRF

  • Vendor/TechGoogle Plus Share

  • SeverityHIGH

  • CVSS Score7.1

  • EPSS Probability0.06%

  • Known ExploitedNo
  • CVSS Vector
  • CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
  • Impact Assessment
  • ConfidentialityLow
  • IntegrityLow
  • AvailabilityLow
  • CWE References
  • CWE-352
  • Technical References
  • Patchstack WordPress Vulnerability Advisory
  • Latest CVEs
  • CVE-2024-8261: Prolizyazilim OBS Auth Bypass Vulnerability

  • CVE-2024-13068: LimonDesk Auth Bypass Vulnerability

  • CVE-2025-53679: Fortinet FortiSandbox RCE Vulnerability

  • CVE-2026-9446: Simple POS Inventory System SQLi Flaw
Default Legacy - Prefooter | Experience the World’s Most Advanced Cybersecurity Platform

Experience the Most Advanced Cybersecurity Platform

See how the world’s most intelligent, autonomous cybersecurity platform can protect your organization today and into the future.

Try SentinelOne
  • Get Started
  • Get a Demo
  • Product Tour
  • Why SentinelOne
  • Pricing & Packaging
  • FAQ
  • Contact
  • Contact Us
  • Customer Support
  • SentinelOne Status
  • Language
  • Platform
  • Singularity Platform
  • Singularity Endpoint
  • Singularity Cloud
  • Singularity AI-SIEM
  • Singularity Identity
  • Singularity Marketplace
  • Purple AI
  • Services
  • Wayfinder TDR
  • SentinelOne GO
  • Technical Account Management
  • Support Services
  • Verticals
  • Energy
  • Federal Government
  • Finance
  • Healthcare
  • Higher Education
  • K-12 Education
  • Manufacturing
  • Retail
  • State and Local Government
  • Cybersecurity for SMB
  • Resources
  • Blog
  • Labs
  • Case Studies
  • Videos
  • Product Tours
  • Events
  • Cybersecurity 101
  • eBooks
  • Webinars
  • Whitepapers
  • Press
  • News
  • Ransomware Anthology
  • Company
  • About Us
  • Our Customers
  • Careers
  • Partners
  • Legal & Compliance
  • Security & Compliance
  • Investor Relations
  • S Foundation
  • S Ventures

©2026 SentinelOne, All Rights Reserved.

Privacy Notice Terms of Use

English