CVE-2014-9311

Shareaholic < 7.6.0.9 - Authenticated Cross-Site Scripting via location[id] Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2014-9311. PoCs published by Kacper Szurek.

AI-analyzed exploit summary This exploit demonstrates a stored XSS vulnerability in Shareaholic 7.6.0.3, where the `location[id]` parameter is not properly escaped, allowing arbitrary JavaScript execution in the context of an admin user.

Description

Cross-site scripting (XSS) vulnerability in admin.php in the Shareaholic plugin before 7.6.1.0 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the location[id] parameter in a shareaholic_add_location action to wp-admin/admin-ajax.php.

Exploits (1)

exploitdb WORKING POC
by Kacper Szurek · textwebappsphp
https://www.exploit-db.com/exploits/36674

This exploit demonstrates a stored XSS vulnerability in Shareaholic 7.6.0.3, where the `location[id]` parameter is not properly escaped, allowing arbitrary JavaScript execution in the context of an admin user.

Classification
Working Poc 100%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: Shareaholic WordPress Plugin 7.6.0.3
Auth required
Prerequisites: Registered user account on the WordPress site
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3

Scores

EPSS 0.0389
EPSS Percentile 88.9%

Details

CWE
CWE-79
Status published
Products (1)
shareaholic/shareaholic < 7.6.0.9
Published Apr 14, 2015
Tracked Since Feb 18, 2026