AccessPress Social Icons Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in the AccessPress Social Icons WordPress plugin, specifically in version 1.8.2. This vulnerability allows authenticated attackers to inject malicious JavaScript into the 'icon title' field. The injected scripts are executed when the plugin page is accessed, impacting all users who view the plugin interface.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the plugin page.

Reproduction

To reproduce this vulnerability, install WordPress and activate the AccessPress Social Icons plugin version 1.8.2. Navigate to the plugin's 'add new' field and enter a JavaScript payload, such as an image tag with an 'onerror' event, into the 'icon title' field. Once the icon is added to the list, the payload will be executed when the plugin page is viewed.