CVE-2014-4717

Multiple cross-site request forgery (CSRF) vulnerabilities in the Simple Share Buttons Adder plugin before 4.5 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) ssba_share_text parameter in a save action to wp-admin/options-general.php, which is not properly handled in the homepage, and unspecified vectors related to (2) Pages, (3) Posts, (4) Category/Archive pages or (5) post Excerpts.

• sharethis simple share buttons adder (<= 4.4) • sharethis simple share buttons adder 1.0 • sharethis simple share buttons adder 1.1 • sharethis simple share buttons adder 1.2 • sharethis simple share buttons adder 1.3 • sharethis simple share buttons adder 1.4 • sharethis simple share buttons adder 1.5 • sharethis simple share buttons adder 1.6 • sharethis simple share buttons adder 1.7 • sharethis simple share buttons adder 1.8 • sharethis simple share buttons adder 1.9 • sharethis simple share buttons adder 2.0 • sharethis simple share buttons adder 2.1 • sharethis simple share buttons adder 2.2 • sharethis simple share buttons adder 2.3 • sharethis simple share buttons adder 2.4 • sharethis simple share buttons adder 2.5 • sharethis simple share buttons adder 2.6 • sharethis simple share buttons adder 2.7 • sharethis simple share buttons adder 2.8 • sharethis simple share buttons adder 2.9 • sharethis simple share buttons adder 3.0 • sharethis simple share buttons adder 3.1 • sharethis simple share buttons adder 3.2 • sharethis simple share buttons adder 3.3 • sharethis simple share buttons adder 3.4 • sharethis simple share buttons adder 3.5 • sharethis simple share buttons adder 3.6 • sharethis simple share buttons adder 3.7 • sharethis simple share buttons adder 3.8 • sharethis simple share buttons adder 3.9 • sharethis simple share buttons adder 4.0 • sharethis simple share buttons adder 4.1 • sharethis simple share buttons adder 4.2 • sharethis simple share buttons adder 4.3