Social Share Buttons CVE-2026-109702

Exploitation requires the attacker to reach an input field processed by the Social Share Buttons plugin (through 1.31) and persist a script payload that is later rendered without proper output neutralization. Successful code execution is LIMITED by the need for a victim to subsequently view the affected page (UI:R per the CVSS vector), so impact is realized only when a logged-in user or administrator loads the poisoned content. The CVSS vector states PR:N (no privileges), but stored XSS in WordPress plugins typically requires at least a low-privilege authenticated account to store the payload unless a specific unauthenticated input sink exists - the exact feature and privilege level are not specified in the description and should be confirmed with the Patchstack advisory. Affects only installations running the plugin at or below version 1.31.

This is a stored cross-site scripting (CWE-79) flaw in the maxfoundry 'Social Share Buttons' WordPress plugin (versions up to 1.31), carrying a CVSS 3.1 base score of 7.1 (vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). The vector signals network-reachable, low-complexity exploitation with a scope change (S:C, reflecting script execution crossing into the victim's browser trust context) but only partial confidentiality, integrity, and availability impact. No EPSS score, CISA KEV listing, or SSVC decision data was provided, and no public proof-of-concept is referenced - the lone source is a Patchstack database advisory. Exploitation status: no public exploit identified at time of analysis. A notable tension exists in the supplied data: the vector asserts PR:N (unauthenticated), yet stored XSS in WordPress plugins almost always requires at least a low-privilege authenticated account (e.g., contributor/author) to persist the payload, or a specific unauthenticated input sink - the exact injection point is not described, so the PR:N claim should be verified against the Patchstack advisory. Overall this is a moderate, not emergency, priority: a genuine stored-XSS bug worth patching, but with no evidence of active exploitation, dependent on victim interaction (UI:R), and limited to partial impact rather than full site takeover.

An attacker stores a malicious script payload through an input field handled by the Social Share Buttons plugin; the payload is persisted and rendered unsanitized on a page. When an administrator or other user later views the affected page, the script executes in their browser session, enabling session/cookie theft or actions performed as that user. No public proof-of-concept exploit is referenced, and successful execution depends on a victim viewing the poisoned page (UI:R).