CVE-2021-36849: 
WordPress vulnerability analysis and mitigation

CVE-2021-36849 is an authenticated stored Cross-Site Scripting (XSS) vulnerability affecting René Hermenau's Social Media Share Buttons (MashShare) WordPress plugin versions 3.8.1 and below. The vulnerability was discovered and disclosed on June 16, 2022 (Patchstack).

The vulnerability stems from improper sanitization and escaping of input values in the plugin's settings. This allows authenticated users with administrative privileges to perform stored Cross-Site Scripting attacks, even when the unfiltered_html capability is disallowed, such as in multisite setups. The vulnerability has been assigned a CVSS v3.1 base score of 4.8 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N (NVD).

If exploited, this vulnerability could allow authenticated administrators to inject malicious scripts, which could lead to various attacks including redirects, unwanted advertisements, and execution of arbitrary HTML payloads when users visit the affected site (Patchstack).

The vulnerability has been patched in version 3.8.5 of the MashShare plugin. Site administrators are advised to update to version 3.8.5 or later to resolve the security issue (WordPress).