Executive brief
The Super Socializer plugin for WordPress, which provides social media sharing and login features, is vulnerable to a security flaw that allows attackers to run malicious scripts in a user's browser. By tricking a site visitor or administrator into clicking a specially crafted link, an attacker could potentially steal session information or perform unauthorized actions on their behalf. This issue affects all websites using version 7.14.5 or earlier of the plugin.
Technical details
The Super Socializer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the 'heateor_mastodon_share' parameter within the helper.php file. An unauthenticated remote attacker can exploit this by crafting a malicious URL containing a script payload and tricking a victim into clicking it. When the victim visits the link, the script executes within the context of their browser session. This can lead to the theft of sensitive information, such as session cookies, or the execution of arbitrary actions on behalf of the user. The vulnerability exists in all versions up to and including 7.14.5.
Affected products
- the_champ Social Share, Social Login and Social Comments Plugin – Super Socializer <= 7.14.5
Timeline
- 2026-07-08: disclosed: Initial publication of the CVE record.
- 2026-07-08: advisory