CVE-2018-6357

PoC —

CVSS 3.0

8.8 high

EPSS

<1%p49

Published

Jan 27, 2018 (Jan 27, 2018)

Modified

Jun 17, 2026

Description

The acx_asmw_saveorder_callback function in function.php in the acurax-social-media-widget plugin before 3.2.6 for WordPress has CSRF via the recordsArray parameter to wp-admin/admin-ajax.php, with resultant social_widget_icon_array_order XSS.

Vendors: acurax
Products: social media widget
Ecosystems: WordPress
Weakness: CWE-79, CWE-352
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.6%)

In the news0 stories

No ingested article mentions this CVE yet.