Shariff Wrapper

Shariff Wrapper has 7 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; all 7 are fixed as of September 2026. Their average CVSS score is 6.6, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 0 high. 2024 was the busiest year with 6 disclosures.

The most common weakness is Cross-Site Scripting, behind 6 of the records (86%). Other recurring categories include Path Traversal.

Every one of the 7 issues recorded for Shariff Wrapper has a vendor fix available, so running the current release closes all known holes.

7 independent researchers contributed these findings, one record each. Shariff Wrapper is installed on roughly 30,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.

Strategic Overview

Avg CVSSMedium

6.6/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Shariff Wrapper vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2024-4098

Shariff Wrapper <= 4.6.13 - Unauthenticated Local File Inclusion

Read the full analysis

Vulnerability Records

7 records


2026-05-27 19:48	Shariff Wrapper <= 4.6.20 - Authenticated (Contributor+) Cross-Site Scripting Shariff Wrapper <= 4.6.20	`CVE-2026-4334`	6.4 Medium	Muhammad Yudha - DJ	Yes
2024-06-19 00:00	Shariff Wrapper <= 4.6.13 - Unauthenticated Local File Inclusion Shariff Wrapper <= 4.6.13	`CVE-2024-4098`	9.8 Critical	haidv35	Yes
2024-06-14 19:57	Shariff Wrapper <= 4.6.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Shariff Wrapper <= 4.6.13	`CVE-2024-2695`	6.4 Medium	Ngô Thiên An (ancorn_)	Yes
2024-03-12 00:00	Shariff Wrapper <= 4.6.10 - Authenticated (Contributor+) Stored Cross-Site Scripting Shariff Wrapper <= 4.6.10	`CVE-2024-1450`	6.4 Medium	Richard Telleng (stueotue)	Yes
2024-03-12 00:00	Shariff Wrapper <= 4.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting Shariff Wrapper <= 4.6.9	`CVE-2024-0966`	6.4 Medium	Muhammad Daffa	Yes
2024-03-12 00:00	Shariff Wrapper <= 4.6.9 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode Shariff Wrapper <= 4.6.9	`CVE-2023-6500`	6.4 Medium	Rafshanzani Suhada	Yes
2024-02-05 00:00	Shariff Wrapper <= 4.6.9 - Authenticated (Admin+) Stored Cross-Site Scripting Shariff Wrapper <= 4.6.9	`CVE-2024-1106`	4.4 Medium	Dmitrii Ignatyev	Yes

Showing 1–7 of 7 reports

Latestv4.6.22

Shariff Wrapper

Author

3UU

4.9(101)

98/100

Last Updated

2026-05-15 (4mo ago)

Active Installs

30,000+

Downloads

1,216,298

Requires WP

4.9+

Requires PHP

7.4+

Tested up to

WP 6.9.7

Created

2014-12-01 (12y ago)

The “original” share buttons automatically transmit data of your visitors to the social network sites as soon as they visit your website. They do not need to click on a share button for this and therefore have no choice, if they want their data to be send. The German computer magazine c’t has developed “Shariff” (ʃɛɹɪf) that follows the General Data Protection Regulation (GDPR – Regulation (EU) 2016/679). This plugin adapts the Shariff concept and provides an easy to use solution for WordPress. We currently support 31 services in 25 languages: Bitcoin, Bluesky, Buffer, Diaspora, Facebook, Flipboard, Info, Linkedin, mailto, Mastodon, Mewe, Mix, Odnoklassniki, Patreon, Paypal, Paypal.me, Pinterest, Pocket, Printer, Reddit, RSS, SMS, Telegram, Threema, Tumblr, Twitter, VK, Wallabag, Weibo, Whatsapp, Xing For more information about the Shariff project check out the original GitHub project and read about the project itself c’t information page (in German). You can automatically add share buttons to posts, pages, the main blog page, product sites and many more as well as use it as a widget or add the shortcode [shariff] manually to your pages or themes.

View on WordPress.org