Executive brief
AccessPress Social Icons is a WordPress plugin used to display social media links on websites. A security flaw allows an authorized user to inject malicious scripts into the 'icon title' field. When other administrators or users view the plugin's settings page, these scripts execute automatically, which could lead to unauthorized actions or the theft of sensitive session information.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in AccessPress Social Icons version 1.8.2. The vulnerability is located in the 'icon title' input field within the 'Add New' icon interface. An authenticated attacker with sufficient privileges to modify plugin settings can inject arbitrary JavaScript (e.g., using <img> tags with onerror handlers). Because the input is not properly neutralized before being stored in the database and subsequently rendered, the payload executes in the context of any user who views the plugin's management interface. The plugin has since been closed and removed from the WordPress plugin directory due to guideline violations.
Affected products
- AccessPress Themes AccessPress Social Icons 1.8.2
Timeline
- 2021-11-12: disclosed: Initial exploit POC published on Exploit-DB
- 2023-03-30: other: Plugin closed on WordPress.org due to guideline violations
- 2026-05-10: advisory: CVE published/updated via VulnCheck