CVE-2024-2118

CVE-2024-2118 describes a stored Cross-Site Scripting (XSS) vulnerability in the Social Media Share Buttons & Social Sharing Icons WordPress plugin prior to version 2.8.9. This flaw allows high-privilege users, such as administrators, to inject malicious scripts due to insufficient sanitization of plugin settings, even in environments where unfiltered_html is restricted. The vulnerability has a CVSS score of 5.9 (MEDIUM), indicating a network-based attack with low complexity, requiring high privileges and user interaction, leading to potential low impact on confidentiality, integrity, and availability. While the EPSS score is low, suggesting a minimal likelihood of exploitation, the FAUCET Risk Score is 29/100. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules for Metasploit or Nuclei, or entries in ExploitDB. Community discussion and media coverage for this CVE are also minimal, suggesting it has not garnered significant attention.