CVE-2015-3299

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Cross-site scripting (XSS) vulnerability in the Floating Social Bar plugin before 1.1.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via vectors related to original service order.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2015/04/13/10Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/74053Third Party Advisory, VDB Entry
https://plugins.trac.wordpress.org/changeset/1129648/floating-social-bar/trunkPatch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/04/13/10Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/74053Third Party Advisory, VDB Entry
https://plugins.trac.wordpress.org/changeset/1129648/floating-social-bar/trunkPatch, Third Party Advisory

Timeline

Published: Sep 19, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-33004.3Multiple cross-site scripting (XSS) vulnerabilities in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Pl CVE-2015-33014.0Directory traversal vulnerability in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for W CVE-2015-33027.5The TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote CVE-2015-330610.0The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.CVE-2015-33077.5The phar_parse_metadata function in ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attacker CVE-2015-33087.5Double free vulnerability in lib/x509/x509_ext.c in GnuTLS before 3.3.14 allows remote attackers to cause a denial of service or possibly ha CVE-2015-33097.5Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.2 through 1.5.4 allows remote attackers to read arbitrary files wi CVE-2015-33104.3Buffer overflow in the rc_mksid function in plugins/radius/util.c in Paul's PPP Package (ppp) 2.4.6 and earlier, when the PID for pppd is gr CVE-2015-33139.8SQL injection vulnerability in WordPress Community Events plugin before 1.4.CVE-2015-33148.1SQL injection vulnerability in WordPress Tune Library plugin before 1.5.5.CVE-2015-33157.8Automatic Bug Reporting Tool (ABRT) allows local users to read, change the ownership of, or have other unspecified impact on arbitrary files CVE-2015-33164.6CA Common Services, as used in CA Client Automation r12.5 SP01, r12.8, and r12.9; CA Network and Systems Management r11.0, r11.1, and r11.2;