CVE-2025-5259

Published
View on NVD ↗
CVSS v3
6.4
MEDIUM
CVSS v2
N/A
Affected
1
PROJECT

Description

The Minimal Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ parameter in all versions up to, and including, 1.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

<p>Add simple share buttons under your posts, add share block in the new editor, or use the widget to add sharing to any widget area your theme provides. This plugin uses simple SVG icons for social network logos and small vanilla JavaScript to allow the user to share the current post or page. Share icons inherit their colours from the theme link colours to match the website design.</p> <p>Why choose Minimal Share Buttons before other similar plugins?</p> <ul> <li>Minimal and elegant look that blends with your theme (tested with all latest default WordPress themes as well as with some other popular themes).</li> <li>Minimal impact on your site&#8217;s performance &#8211; the plugin loads only a small SVG file with the icons, less than 1k CSS and 3.5к unminified and uncompressed JavaScript &#8211; most of it to make SVG icons work in old browsers.</li> <li>Doesn&#8217;t spy on your users &#8211; the plugin doesn&#8217;t load any thitd-party scripts that record your user&#8217;s activity on your site, doesn&#8217;t set or read any cookies.</li> <li>Sharing through the native share dialog on devices that support it.</li> <li>GDPR-hasle-free &#8211; since the plugin doesn&#8217;t leak personal information to third parties, this makes it easier for website owners to comply with the European privacy regulations.</li> <li>Accessibility &#8211; the share links have labels, read by screen readers, and visible for keyboard users.</li> <li>Gutenberg and WordPress 5.0 ready &#8211; the plugin provides block that displays the share buttons so that authors can place them wherever they want in the post content.</li> </ul> <h3>Usage</h3> <p>There are five ways of displaying the share buttons on a post or page:</p> <ol> <li>Force them to display under the content of the post by checking the relevant checkboxes in the Display settings sections on the plugin settings screen.</li> <li>Add Share widget to the sidebar or another widget area.</li> <li>Use the Gutenberg block to add the share buttons whereever you want in the post content.</li> <li>Use the shortcode <code>[msb_share title="Share this"]</code> in the classic editor.</li> <li>Use the function <code>msb_display_buttons()</code> to render the widget in your theme templates.</li> </ol> <h3>Theme developers</h3> <p>From version 1.4 you can more easily display the sharing widget in your templates using the function <code>msb_display_buttons()</code>. The function accepts two arguments &#8211; an array of options, passed to the widget, and a second boolean argument that tells the function to echo the resulting markup. Here&#8217;s an example:</p> <pre><code>$args = [ 'before_widget' =&gt; '&amp;lt;div class="msb-container"&gt;', 'after_widget' =&gt; '&amp;lt;/div&gt;', 'before_title' =&gt; '&amp;lt;h2&gt;', 'after_title' =&gt; '&amp;lt;/h2&gt;', 'title' =&gt; __( 'Share this article', 'mytextdomain' ), ]; msb_display_buttons( $args, true ); </code></pre> <p>If your theme uses SVG icons, combined into a SVG sprite, and your sprite has icons for Facebook, Twitter, Google+ and LinkedIn, there are two filters you can use to replace the icons, provided by the plugin, with yours. The results of the two filters are concatenated with a hash between them and passed through <code>esc_url</code> before output.</p> <p>Another filter allows manipulation of the array of social networks.</p> <h3>msb_sprite_url</h3> <p>The filter is applied to the URL of the sprite image and the filter function should return the URL (without the hash sign) of an SVG sprite image, consisting of icons in <code>symbol</code> elements.</p> <h3>msb_icon_name</h3> <p>The filter is applied to the icon name before concatenating it to the sprite URL. It should return the ID of the icon symbol in the sprite.</p> <h3>msb_icon</h3> <p>The filter allows to change the whole icons markup, It receives the icon markup and the icon name as parameters.</p> <h3>msb_socials</h3> <p>The filter is applied to the default list of social networks and allows adding or removing socials networks. The array of social networks is associative array, the key is used for the option name on settings page and for the icon ID, and the value is associative array with three elements &#8211; <code>field_label</code> (the label of the field in settings), <code>button_label</code> (the label of the button for screenreader users), and <code>share_url</code> (the URL for sharing links). The <code>share_url</code> is passed through <code>sprintf</code> with two params &#8211; the URL of the current page and the title of the page. Example:</p> <pre><code>function my_add_xing( $socials ){ $socials['xing'] = array( 'field_label' =&gt; __( 'Xing', 'mytheme' ), 'button_label' =&gt; __( 'Share on Xing', 'mytheme' ), 'share_url' =&gt; 'https://www.xing.com/spi/shares/new?url=%1$s&amp;title=%2$s' ); return $socials; } add_filter( 'msb_socials', 'my_add_xing' );&lt;h3&gt;msb_button_classes&lt;/h3&gt; </code></pre> <p>This filter allows changing the classes of the individual buttons. Two parameters are apssed to the filter functions: the array with classes and the social network / button slug.</p> <h3>Credits</h3> <ul> <li>SVG Icons from <a href="https://fontawesome.com/" rel="nofollow ugc">FontAwesome</a>, <a href="https://creativecommons.org/licenses/by/4.0/" rel="nofollow ugc">Creative Commons CC BY 4.0</a>, MIT licence</li> <li>Banner image by <a href="https://pixabay.com/en/share-play-words-2482016/" rel="nofollow ugc">heinzremyschindler on pixbay</a>, <a href="https://creativecommons.org/publicdomain/zero/1.0/deed.en" rel="nofollow ugc">Creative Commons CC0</a></li> <li>Plugin icon based on <a href="https://thenounproject.com/term/share/107273/" rel="nofollow ugc">work by Nathan Diesel from the Noun Project</a>, <a href="http://creativecommons.org/licenses/by/3.0/us/" rel="nofollow ugc">Creative Commons CC-BY</a></li> </ul>
WordPress Plugin DirectoryWordPress Plugin Directory
6.15K