Description
WordPress Plugin AddToAny Share Buttons is prone to a host header injection vulnerability because it fails to properly validate an HTTP request header. A successful attack may allow attackers to insert a crafted host header to navigate the victim to the attacker's domain. WordPress Plugin AddToAny Share Buttons version 1.7.14 is vulnerable; prior versions may also be affected.
Remediation
Update to plugin version 1.7.15 or latest
References
Related Vulnerabilities
WordPress Plugin MapPress Maps for WordPress Security Bypass (2.54.5)
WordPress 2.1.1 Command Execution Backdoor Vulnerability (2.1.1)
Zikula Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2014-2293)
WordPress Plugin RokStories Multiple Vulnerabilities (1.25)
Liferay DXP URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2024-25608)