CVE-2023-5070

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.8.5 via the sfsi_save_export function. This can allow subscribers to export plugin settings that include social media authentication tokens and secrets as well as app passwords.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
inisev	Social Media Share Buttons & Social Sharing Icons	<= 2.8.5

References

Timeline

Published: Oct 20, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-507007.8Insecure Permissions vulnerability in Deepin dde-file-manager 6.0.54 and earlier allows privileged operations to be called by unprivileged u CVE-2023-507028.8Sikka SSCWindowsService 5 2023-09-14 executes a program as LocalSystem but allows full control by low-privileged users (and low-privileged u CVE-2023-507035.9An attacker with network access could perform a man-in-the-middle (MitM) attack and capture sensitive information to gain unauthorized acces CVE-2023-507046.1An attacker could construct a URL within the application that causes a redirection to an arbitrary external domain and could be leveraged to CVE-2023-507055.3An attacker could create malicious requests to obtain sensitive information about the web server.CVE-2023-507064.3A user without administrator permissions with access to the UC500 windows system could perform a memory dump of the running processes and ex CVE-2023-507077.5Through the exploitation of active user sessions, an attacker could send custom requests to cause a denial-of-service condition on the devic CVE-2023-507089.8yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient p CVE-2023-507097.5Cube is a semantic layer for building data applications. Prior to version 0.34.34, it is possible to make the entire Cube API unavailable by CVE-2023-50715.4The Sitekit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'sitekit_iframe' shortcode in versions up to, and includin CVE-2023-507104.3Hono is a web framework written in TypeScript. Prior to version 3.11.7, clients may override named path parameter values from previous reque CVE-2023-507119.8vmm-sys-util is a collection of modules that provides helpers and utilities used by multiple rust-vmm components. Starting in version 0.5.0