Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2018-0579: Open Graph plugin lets attackers add malicious script to sites

CVE-2018-0579 · published 8 years ago

Summary

The WordPress plugin Open Graph for Facebook, Google+ and Twitter Card Tags (versions before 2.2.4.1) can be tricked into inserting harmful code into your pages. This could let outsiders steal visitor information or take control of the site’s appearance. Update the plugin to version 2.2.4.1 or newer, or disable it if you don’t need the feature.

What to do

Update webdados open_graph_for_facebook\,_google\+_and_twitter_card_tags to version 2.2.4.1 or later.

Affected software

Vendor	Product	Affected versions
webdados	open_graph_for_facebook\,_google\+_and_twitter_card_tags	< 2.2.4.1 `cpe:2.3:a:webdados:open_graph_for_facebook\,_google\+_and_twitter_card_tags::::::wordpress::*`

Original advisory text

Cross-site scripting vulnerability in Open Graph for Facebook, Google+ and Twitter Card Tags plugin prior to version 2.2.4.1 for WordPress allows remote attackers to inject arbitrary web script or ...

References

http://jvn.jp/en/jp/JVN08386386/index.html Third Party Advisory VDB Entry
https://wordpress.org/plugins/wonderm00ns-simple-facebook-open-graph-tags/#devel... Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.1 Medium

Exploitation

1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published14 May 2018

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2018-0579 · NVD

Track software like this

Free during beta