WPUpper Share Buttons WordPress Plugin Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the WPUpper Share Buttons plugin for WordPress, affecting all versions through 3.51. The issue arises from inadequate nonce validation in the 'save_custom_css_request' function, allowing unauthenticated attackers to inject custom CSS. This could be exploited by tricking a site administrator into clicking a link that sends a forged request.

Impact

Exploitation of this vulnerability allows for Cross-Site Request Forgery, where an attacker can inject custom CSS into a site, potentially leading to unauthorized modifications of the site's appearance or functionality.

Remediation

Users are advised to update the WPUpper Share Buttons plugin to version 3.52 or a newer patched version.