Social Share Buttons CVE-2026-100108

Requires an authenticated WordPress account with subscriber-level privileges or higher on the target site (PR:L). Critically, exploitation is gated by the plugin's review-nag logic: the attacker must wait until the 7-day review-nag timer has elapsed since their account's first wp-admin visit, because the nonce required to reach the vulnerable save-network handler is only rendered in the DOM after that timer expires - a per-account time delay that limits immediate exploitation. The vulnerable input is the 'form' parameter containing 'share_url', which lacks sufficient input sanitization and output escaping. The payload fires when any user subsequently views an injected page. Limiting factors: a valid low-privilege account is needed, the 7-day delay must pass, and the target must run Social Share Buttons version ≤1.30.

This is a genuine but moderate-priority issue, not a top-tier emergency. The input CVSS of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) reflects a network-reachable stored XSS requiring only subscriber-level authentication, with a scope change (S:C) because injected script executes in other users'/administrators' browser context. No EPSS score, CISA KEV listing, or POC was provided, so there is no signal of active or imminent exploitation - exploitation status is 'no public exploit identified at time of analysis.' A SSVC assessment would land on low urgency: not actively exploited, not trivially automatable (the attacker needs a valid low-privilege account on the target site), and partial technical impact. The single most important caveat is that the input vector's AC:L appears to UNDERSTATE real-world difficulty: the description states exploitation is only possible once a per-account 7-day review-nag timer has elapsed since the attacker's first wp-admin visit, because the nonce needed to reach the save-network handler is rendered only after that timer passes. This time-gated precondition argues the practical attack complexity is higher than AC:L suggests - verify with the vendor. Net: a legitimate stored-XSS flaw worth patching, but the low privilege requirement is offset by the account prerequisite and the mandatory 7-day delay, keeping real-world risk moderate rather than critical.

An attacker registers or obtains a subscriber-level WordPress account on a site running Social Share Buttons ≤1.30 and waits until 7 days after their first wp-admin visit, at which point the review-nag nonce exposes the save-network handler. They submit a crafted 'form' value (containing share_url) with an unsanitized script payload, which is stored and later executes in the browser of any user - including administrators - who views the affected page. No public exploit code was identified in the provided data.