View online: https://www.drupal.org/sa-contrib-2023-006 Project: Better Social Sharing Buttons [1] Date: 2023-March-01 Security risk: *Less critical* 8∕25 AC:Basic/A:User/CI:None/II:None/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Description:  This module enables you to add social sharing buttons to a site. The module doesn't sufficiently sanitize the weight and ratio values entered in the module or block configuration. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer blocks". Solution:  Install the latest version: * If you use the Better Social Sharing Buttons module for Drupal 9 or 10, upgrade to Better Social Sharing Buttons 4.0.3 [3] Reported By:  * cydave [4] Fixed By:  * cydave [5] * Shelane French [6] Coordinated By:  * Damien McKenna [7] of the Drupal Security Team [1] https://www.drupal.org/project/better_social_sharing_buttons [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/better_social_sharing_buttons/releases/4.0.3 [4] https://www.drupal.org/user/3751740 [5] https://www.drupal.org/user/3751740 [6] https://www.drupal.org/user/2674989 [7] https://www.drupal.org/user/108450