Social Media & Share Icons CVE-2026-66623

The CVSS vector (PR:N) confirms no authentication is required to deliver the malicious payload to the server. Exploitation is bounded by user interaction (UI:R) - a victim must load a page or follow a link that causes the plugin to render the unsanitized input in their browser. The scope change (S:C) indicates the injected script executes beyond the plugin's own context, affecting the victim's browser session. Exploitation is limited to WordPress installations where the Social Media & Share Icons plugin by Inisev is actively installed and enabled at version 2.9.9 or earlier; sites that have deactivated or removed the plugin are not affected. No specific non-default configuration is identified as a prerequisite - the vulnerability appears to be present in the plugin's default operating state on any page where it renders output.

The CVSS 3.1 score of 7.1 (High) is driven by AV:N/AC:L/PR:N (network-accessible, low complexity, no authentication) combined with scope change, placing this in a realistic exploitation category. The required user interaction (UI:R) is the primary limiting factor - fully automated exploitation without a victim loading a page is not possible. No EPSS score is present in the input, so exploitation probability cannot be quantified numerically; however, the unauthenticated, low-complexity nature suggests mass opportunistic exploitation would be feasible if a public proof-of-concept were to emerge. No KEV listing and no known POC exist at time of analysis, making this currently a patch-priority item rather than an emergency incident response trigger. The scope change elevates real-world impact: successful exploitation targeting a logged-in WordPress admin could lead to privilege escalation within the site. This is a genuine High priority for any WordPress deployment running the affected plugin, not merely a high-CVSS-low-real-risk finding.

An attacker identifies a WordPress site running Social Media & Share Icons ≤ 2.9.9 and crafts a URL or page embedding a JavaScript payload through an unsanitized plugin parameter. The attacker delivers this link to a logged-in WordPress administrator via phishing or comment injection; when the admin loads the page, the script executes in their browser, exfiltrating their session cookie or performing administrative actions on their behalf. No public proof-of-concept exploit code has been identified at time of analysis, but the low-complexity, zero-authentication vector means exploitation requires minimal technical sophistication once the injection point is identified.