CVE-2024-8790: Social Share With Floating Bar XSS Vulnerability

CVE-2024-8790 Overview

CVE-2024-8790 is a Reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Social Share With Floating Bar plugin for WordPress. The flaw affects all versions up to and including 1.0.3. The plugin uses add_query_arg without proper escaping on the returned URL, allowing attackers to inject arbitrary JavaScript into rendered pages. Exploitation requires user interaction, such as clicking a crafted link. Unauthenticated attackers can trigger the vulnerability against any authenticated visitor.

Critical Impact
Successful exploitation executes attacker-controlled scripts in the victim's browser session, enabling session theft, credential harvesting, and administrative account compromise on affected WordPress sites.

Affected Products

Themeinwp Social Share With Floating Bar plugin for WordPress
All versions up to and including 1.0.3
WordPress sites with the vulnerable plugin activated

Discovery Timeline

2024-10-18 - CVE-2024-8790 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8790

Vulnerability Analysis

The vulnerability resides in inc/class-social-share-with-floating-bar-settings.php at line 312, where the plugin calls add_query_arg and outputs the resulting URL without escaping. The WordPress add_query_arg function preserves attacker-controlled input from the request URI when no explicit URL is passed. When that result is echoed into an HTML context without esc_url or esc_attr, injected payloads render as active markup. The attacker crafts a URL containing malicious query parameters and delivers it to a target. When the victim visits the affected admin page, the payload executes in the browser under the site's origin.

Root Cause

The root cause is missing output encoding on a reflected value. The plugin trusts the URL constructed by add_query_arg and writes it directly into the page. WordPress documentation explicitly warns that this function's output must be escaped before being emitted in HTML or attribute contexts.

Attack Vector

The attack is network-based and requires user interaction. An attacker constructs a link to the vulnerable settings page with injected script content in the query string. Delivery typically occurs through phishing email, forum posts, or malicious advertisements. When an authenticated administrator clicks the link, the injected script executes in the WordPress admin context, enabling session token theft, forced configuration changes, or plugin/theme installation leading to code execution.

No verified proof-of-concept code has been published. Refer to the Wordfence Vulnerability Report and the WordPress Plugin Code Change for source-level details.

Detection Methods for CVE-2024-8790

Indicators of Compromise

Web server access logs containing requests to WordPress admin pages with unusual query string parameters embedding <script>, javascript:, onerror=, or URL-encoded equivalents (%3Cscript%3E)
Referrer headers pointing to external, untrusted domains that immediately precede requests to plugin settings URLs
Unexpected creation of administrator accounts, new plugin installations, or modifications to theme files following admin sessions

Detection Strategies

Deploy web application firewall rules that flag reflected script payloads and encoded HTML entities in query parameters targeting /wp-admin/ paths
Perform static analysis on plugin source for calls to add_query_arg and remove_query_arg that are not wrapped in esc_url or esc_url_raw
Correlate WordPress audit logs to identify administrative actions immediately following clicks on externally-referred URLs

Monitoring Recommendations

Monitor for the presence of the vulnerable plugin at versions <= 1.0.3 across managed WordPress deployments
Alert on outbound HTTP requests from browser sessions to attacker-controlled domains originating from /wp-admin/ referrers
Track changes to WordPress user roles, especially unexpected promotion to the administrator role

How to Mitigate CVE-2024-8790

Immediate Actions Required

Inventory WordPress sites and identify installations of the Social Share With Floating Bar plugin at version 1.0.3 or earlier
Deactivate the plugin on any site where a patched version is not yet available
Educate administrators to avoid clicking unverified links to their own WordPress admin URLs

Patch Information

At the time of publication, no vendor-confirmed fixed version is referenced in the NVD entry. Site owners should monitor the WordPress plugin repository for a release above 1.0.3 that wraps the affected add_query_arg output with esc_url. Until a patched release is available, removal of the plugin is the reliable remediation.

Workarounds

Uninstall the plugin entirely if the social sharing functionality is not business-critical
Enforce a Content Security Policy (CSP) that restricts inline script execution in WordPress admin pages
Require administrators to use separate browsers or browser profiles when accessing WordPress admin interfaces to limit session exposure
Deploy a web application firewall with signatures for reflected XSS payloads targeting WordPress plugin endpoints

bash

# Example: disable the vulnerable plugin via WP-CLI across a fleet
wp plugin deactivate social-share-with-floating-bar --allow-root
wp plugin delete social-share-with-floating-bar --allow-root

# Example CSP header for WordPress admin (add via web server config)
# Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'