EUVD-2026-69833
GHSA-5959-3p9c-8939
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Contributor is low privilege (PR:L not PR:H); XSS crosses scope to victim browser (S:C); limited direct system impact but subsequent session theft possible.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not escape the post title before outputting it in an inline JavaScript event handler, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks which are triggered when a visitor interacts with the affected button. Exploitation requires the Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 to be running a non-default icon display configuration.
AnalysisAI
Stored Cross-Site Scripting in the Social Media Share Buttons & Social Sharing Icons WordPress plugin (versions before 3.0.1) allows users with the Contributor role or higher to inject persistent JavaScript payloads via unescaped post titles rendered inside inline event handlers on share buttons. Payload execution is deferred to site visitors who interact with those buttons - enabling session theft or full site compromise if an administrator triggers it. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a WordPress user account with at minimum the Contributor role - Contributors can create posts but typically require editorial approval before publication, meaning a site editor or admin must approve the malicious post before exploitation becomes possible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS score of 6.8 uses PR:H (high privilege), but the description explicitly states exploitation requires only the Contributor role - a low-privilege WordPress role (PR:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Social Media Share Buttons & Social Sharing Icons WordPress plugin to version 3.0.1 or later, as confirmed by the WPScan advisory (https://wpscan.com/vulnerability/c2f7987b-8cac-4c02-97f7-b33bea5b5cc4/). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Reflected Cross-Site Scripting in the Social Media Share Buttons & Social Sharing Icons WordPress plugin (all versions b
The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 2.8.9 does not sanitise and escape some of
The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Sensitive Information Exposu
Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plu
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low at
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Inisev Soci
Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capabili
The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Cross-Site Request Forgery i
The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 2.9.1 does not sanitize and escape some of
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today