CVE-2022-33960 HIGH

CVE-2022-33960: WordPress Social Share Buttons by Supsystic plugin <= 2.2.3 - Multiple Authenticated SQL Injection (SQLi) vulnerabilities

Vendor Supsystic
Product Social Share Buttons by Supsystic (WordPress plugin)
Weakness CWE-89 · SQLi
Published July 22, 2022
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

8.5/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

What the vulnerability does

01Description

Multiple Authenticated (subscriber or higher user role) SQL Injection (SQLi) vulnerabilities in Social Share Buttons by Supsystic plugin <= 2.2.3 at WordPress.

Explanation of Vulnerability in Simple Terms

02Summary

The Social Share Buttons by Supsystic WordPress plugin through version 2.2.3 contains a SQL injection vulnerability in its database queries. An authenticated attacker with low privileges can inject malicious SQL code to read or modify database contents, potentially exposing sensitive site data or user information. The vulnerability affects the plugin's core functionality and requires only network access and valid user credentials.

What an attacker can do

03Attacker Capabilities

Read or modify the WordPress database by injecting SQL commands through the plugin.

Potential impact on your site

04Site Impact

Attackers with user accounts can steal sensitive data, modify posts/pages, or compromise user information stored in your database.

Conditions required to exploit

05Prerequisites

Attacker must have a valid WordPress user account with low-level privileges (e.g., subscriber or contributor role).

Key dates

06Disclosure timeline

July 22, 2022 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-9713 Product Designer for WooCommerce WordPress | Lumise <= 2.1.1 - Unauthenticated SQL Injection via 'id' Parameter in Cart JSON Upload CVE-2026-65761 Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1 CVE-2026-65532 WordPress Persian Woocommerce SMS plugin <= 7.2.2 - SQL Injection vulnerability CVE-2026-13161 TrueBooker <= 1.2.2 - Unauthenticated SQL Injection CVE-2026-16811 ShopLentor <= 3.4.5 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter