A stored XSS vulnerability in the Social Warfare plugin, used by 70 000 users, led to a mass hacking campaign of WordPress websites.
Vulnerable component: WordPress Social Sharing Plugin – Social Warfare
CVSSv3 score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N/E:H/RL:O/RC:C
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The vulnerability allows a remote attacker to perform cross-site scripting attacks.
Note: this vulnerability is being actively exploited in the wild.