What is the CVSS score of CVE-2026-7659?

CVE-2026-7659 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Advanced Social Media Icons CVE-2026-7659

EUVD-2026-29420 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-12 Wordfence

GHSA-3h2h-m559-68x2

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 12, 2026 - 08:48 vuln.today

CVE Published

May 12, 2026 - 07:48 nvd

MEDIUM 6.4

DescriptionCVE.org

The Advanced Social Media Icons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the social shortcode in all versions up to, and including, 1.2. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored cross-site scripting in the Advanced Social Media Icons WordPress plugin through version 1.2 allows authenticated contributors and above to inject arbitrary JavaScript via insufficiently sanitized shortcode attributes, with execution occurring whenever any user views an affected page. The vulnerability affects all installations of the plugin up to and including version 1.2 and requires only Contributor-level WordPress access to exploit, making it a significant risk for multi-author sites.

Technical ContextAI

The Advanced Social Media Icons plugin processes user-supplied input through the social shortcode without proper sanitization and output escaping. The underlying vulnerability stems from CWE-79 (Cross-site Scripting), where dynamic content is rendered into pages without encoding. WordPress shortcodes are processed server-side and their output is directly inserted into page content; when shortcode attributes are not sanitized before processing and not escaped before output, an attacker can embed malicious JavaScript that executes in the context of any visitor's browser session. The CPE identifier cpe:2.3:a:riotweb:advanced_social_media_icons:*:*:*:*:*:*:*:* indicates all versions of the plugin from the vendor Riotweb are affected, with the specific vulnerable code path identified in the plugin's functions.php file at line 40.

RemediationAI

Update the Advanced Social Media Icons plugin to a patched version released after version 1.2 using WordPress administrative interface (Plugins → Updates) or via direct download from https://wordpress.org/plugins/advanced-social-media-icons/. Check the plugin's changelog on the WordPress plugin repository to confirm which version addresses this vulnerability. As an interim workaround on sites that cannot immediately update, restrict Contributor-level permissions to trusted users only and monitor user activity for suspicious shortcode creation; this requires manual access control and does not prevent exploitation by compromised contributor accounts. If the plugin is not essential to site functionality, consider disabling it entirely until a patched version is confirmed available. For sites using the development trunk version, switch back to the latest stable release or wait for a patched release of the trunk version.