Social Media Share Buttons CVE-2026-19723

The Social Media Share Buttons & Social Sharing Icons plugin must be installed at a version earlier than 3.0.1 AND the site operator must have enabled a non-default icon display configuration - default installations are not vulnerable. The victim must actively interact with the affected share button on the page (user interaction required per UI:R). The attacker requires no authentication (PR:N). These two limiting factors - non-default configuration and mandatory user interaction - meaningfully reduce realistic attack surface compared to the raw CVSS score suggests.

The NVD CVSS 7.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) captures the network-reachability and scope-change (browser) aspects accurately, but AC:L arguably understates the practical exploitation difficulty given that the non-default icon display configuration must be active on the target site - a condition beyond attacker control. The A:L metric is anomalous for a reflected XSS and is likely overstated, as XSS does not inherently affect availability. No EPSS data was supplied; given the non-default configuration prerequisite and required user interaction, mass-scale exploitation is structurally constrained. The public PoC from WPScan elevates risk for targeted attacks against sites where the configuration condition is met. No CISA KEV listing; this is a real but bounded risk.

An attacker identifies a WordPress site running the plugin in its non-default icon display mode, then crafts a URL containing a JavaScript payload embedded in the vulnerable request parameter. The attacker delivers this URL to a target user (e.g., a site administrator) via phishing; when the victim visits the page and interacts with an affected share button, the unescaped payload executes in their browser, enabling session cookie theft or unauthorized action on the WordPress site. A public PoC is available via WPScan, lowering the skill barrier for this scenario.