EUVD-2026-14148
GHSA-54jx-h2q6-qwrf
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The Ed's Social Share plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's social_share shortcode in all versions up to, and including, 2.0. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Ed's Social Share plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the social_share shortcode due to insufficient input sanitization and output escaping of user-supplied attributes. All versions up to and including 2.0 are affected, allowing authenticated attackers with contributor-level access or higher to inject arbitrary JavaScript that executes for all users viewing the compromised page. With a CVSS score of 6.4 and network-accessible attack vector requiring only low privileges, this vulnerability poses a moderate-to-significant risk in multi-author WordPress environments.
Technical ContextAI
The vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting), a critical input validation flaw in the WordPress plugin ecosystem. The affected product, Ed's Social Share (CPE: cpe:2.3:a:waianaeboy702:ed's_social_share:*:*:*:*:*:*:*:*), implements a shortcode handler at line 180 of eds_social_share.php that processes shortcode attributes without proper sanitization before rendering them in page content. WordPress shortcodes are executed server-side during page rendering, making stored XSS payloads persistent in the WordPress database and executable whenever the page is accessed. The root cause is the absence of WordPress security functions like sanitize_text_field() during input processing and esc_html(), esc_attr(), or wp_kses_post() during output rendering.
RemediationAI
Immediately disable and remove Ed's Social Share plugin version 2.0 and all earlier versions from affected WordPress installations. If the plugin's functionality is critical, replace it with a maintained alternative from the WordPress plugin repository that implements proper input sanitization and output escaping, such as verified plugins with active security records. If temporary continued use is required, apply manual code patching to line 180 of eds_social_share.php by adding WordPress sanitization functions (sanitize_text_field()) to all shortcode attribute inputs and proper escaping functions (esc_html() or esc_attr()) to all output rendering. Additionally, restrict contributor-level access to only trusted users, implement Web Application Firewall (WAF) rules to detect XSS patterns in shortcode content, and enable WordPress security plugins that provide stored XSS detection and prevention. Further information and exploitation details are available from Wordfence at https://www.wordfence.com/threat-intel/vulnerabilities/id/e4ac5f28-8727-4205-abe5-7f29a0c4dc5d?source=cve.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today