What is the CVSS score of CVE-2026-1923?

CVE-2026-1923 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Social Rocket - Social Sharing Plugin CVE-2026-1923

EUVD-2026-25148 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-23 Wordfence

GHSA-2x2c-w34j-v42x

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 23, 2026 - 07:07 vuln.today

EUVD ID Assigned

Apr 23, 2026 - 01:45 euvd

EUVD-2026-25148

Analysis Generated

Apr 23, 2026 - 01:45 vuln.today

CVE Published

Apr 23, 2026 - 01:24 nvd

MEDIUM 6.4

DescriptionCVE.org

The Social Rocket - Social Sharing Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.3.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in Social Rocket - Social Sharing Plugin for WordPress up to version 1.3.4.2 allows authenticated Subscriber-level users to inject arbitrary JavaScript via the 'id' parameter, which executes in the browsers of all users viewing affected pages. The vulnerability stems from insufficient input sanitization and output escaping, and exploitation requires only subscriber-level WordPress authentication with no user interaction needed beyond the initial injection.

Technical ContextAI

Social Rocket is a WordPress plugin that facilitates social media sharing functionality. The vulnerability exists in the handling of the 'id' parameter within the plugin's code, where user-supplied input is not adequately sanitized before being stored in the WordPress database (persistent/stored XSS condition per CWE-79) and subsequently rendered in page output without proper HTML entity encoding or escaping. WordPress plugins must sanitize input on save and escape output on display; this plugin fails both controls. The attack vector is network-based because the injection occurs through normal WordPress post/page management interfaces, and the exploit requires only WordPress authentication at the Subscriber level, the lowest privilege tier in WordPress that still permits plugin interaction.

RemediationAI

Update Social Rocket - Social Sharing Plugin to a version greater than 1.3.4.2 immediately; consult the WordPress plugin repository at https://plugins.trac.wordpress.org/changeset/3467694/social-rocket to confirm the patched version number. If immediate patching is not possible, implement WordPress-level compensating controls: (1) restrict Subscriber-level user creation and audit existing Subscriber accounts for legitimacy, as only users with Subscriber access or higher can exploit this vulnerability, (2) disable the Social Rocket plugin entirely until patched, (3) use WordPress security plugins to monitor and block XSS payloads in the 'id' parameter via Web Application Firewall (WAF) rules, and (4) regularly audit page/post revisions and comments for injected script content. Note that compensating controls cannot eliminate risk entirely-only patching does-and may introduce false positives or performance overhead depending on implementation.