Social Share Icons CVE-2026-42697

Exploitation requires an unauthenticated attacker to deliver attacker-controlled input that the Social Share Icons & Social Share Buttons plugin (versions <= 3.7.5) renders without proper output encoding, AND requires a victim to interact with that content (UI:R) - typically clicking a crafted link or loading an attacker-influenced page. The attack targets any WordPress site running the affected plugin version; no special non-default configuration is indicated in the description. The primary limiting factor is the mandatory user interaction: the payload cannot fire without a victim action, and highest impact is achieved when the victim is a privileged user (e.g., an administrator) whose session can be abused.

This is a moderate-severity reflected/unauthenticated Cross-Site Scripting flaw (CVSS 7.1) in a WordPress plugin. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) indicates network-reachable, low-complexity exploitation requiring no privileges but DOES require user interaction (UI:R) - the key limiting factor that separates this from a wormable, fully-automatable issue. The scope change (S:C) reflects XSS executing in the victim's browser context, outside the vulnerable component, which is standard for CWE-79 and justifies the elevated-but-not-critical score. No EPSS score, KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis; the only signal of concern is the Patchstack database entry confirming the vulnerability's existence. Weighing the signals together, this is a real-but-routine WordPress plugin XSS: credible and worth patching, but not an emergency - the mandatory user-interaction requirement and absence of any exploitation evidence (no KEV, no POC, no EPSS) argue against widespread active abuse. Note: EPSS data is missing entirely, so probabilistic exploitation likelihood could not be factored in.

An unauthenticated attacker crafts a malicious URL or input that is reflected unsanitized by the Social Share Icons & Social Share Buttons plugin (version 3.7.5 or earlier) and sends it to a victim (e.g., a logged-in site administrator). When the victim clicks the link or views the attacker-influenced content, the injected JavaScript executes in their browser session, potentially hijacking their session or performing actions on their behalf. No public exploit code was identified at time of analysis, and successful execution depends on the victim interacting with the attacker-supplied content (UI:R).