EUVD-2026-69834
GHSA-3qmf-g4j6-v744
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Non-default configuration prerequisite justifies AC:H; A:N because XSS does not cause availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
6DescriptionCVE.org
The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not properly escape a value taken from the incoming request before outputting it in an inline JavaScript event handler, leading to Reflected Cross-Site Scripting which is triggered when a user interacts with the affected button. Exploitation requires the Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 to be running a non-default icon display configuration.
AnalysisAI
Reflected Cross-Site Scripting in the Social Media Share Buttons & Social Sharing Icons WordPress plugin (all versions before 3.0.1) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by embedding a malicious payload in a crafted URL targeting an unescaped request parameter rendered inside an inline JavaScript event handler. Exploitation is constrained to sites running a non-default icon display configuration, and requires the victim to interact with the affected share button. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The Social Media Share Buttons & Social Sharing Icons plugin must be installed at a version earlier than 3.0.1 AND the site operator must have enabled a non-default icon display configuration - default installations are not vulnerable. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 7.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) captures the network-reachability and scope-change (browser) aspects accurately, but AC:L arguably understates the practical exploitation difficulty given that the non-default icon display configuration must be active on the target site - a condition beyond attacker control. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the Social Media Share Buttons & Social Sharing Icons plugin to version 3.0.1 or later, which applies proper escaping to the affected request parameter before rendering it in the JavaScript event handler context. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WordPress installations using the Social Media Share Buttons & Social Sharing Icons plugin and audit which run versions before 3.0.1; prioritize sites using non-default icon display configurations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Stored Cross-Site Scripting in the Social Media Share Buttons & Social Sharing Icons WordPress plugin (versions before 3
The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 2.8.9 does not sanitise and escape some of
The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Sensitive Information Exposu
Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plu
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low at
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Inisev Soci
Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capabili
The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Cross-Site Request Forgery i
The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 2.9.1 does not sanitize and escape some of
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today