Social Media Share Buttons EUVD-2026-90543

Exploitation requires reflected injection via a URL parameter processed by the plugin's WeChat share feature (ultimate-social-media-icons, versions ≤3.0.1). Two concrete limiting conditions apply: the victim must be using a mobile user-agent, and the victim must click the WeChat share icon - only then does the share dialog open and the injected script execute automatically without further interaction. This is unauthenticated from the attacker's side (PR:N) but depends on social-engineering a specific mobile share action, which substantially limits realistic exploitation versus a no-interaction flaw.

This is a textbook reflected XSS (CWE-79) with a moderate 6.1 CVSS (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), and the real-world risk is lower than the network-unauthenticated framing suggests because exploitation is gated by two uncommon preconditions baked into the description: the victim must be on a mobile user-agent AND must actively click the WeChat share icon. The CVSS vector correctly captures this as UI:R with only Low confidentiality/integrity impact and a scope change (reflected script runs in the victim's browser session against the vulnerable page's origin). No EPSS score, no CISA KEV listing, and no public POC were provided, so the exploitation status is 'no public exploit identified at time of analysis' - this is not evidence of active exploitation, and reflected XSS requiring a social-engineered click on a niche mobile share path is more opportunistic/targeted than mass-exploitable. Compared with stored or unauthenticated-no-interaction XSS, the required victim interaction plus the mobile+WeChat constraint meaningfully narrows the attack surface. Overall this is a legitimate but routine patch-when-convenient issue rather than an emergency, with the main concern being the plugin's install base.

An attacker crafts a malicious URL to a page on a site running the plugin, embedding a script payload in a URL parameter that is reflected unsanitized into the WeChat share logic. The attacker lures a mobile victim into clicking the link and then the WeChat share icon; once the share dialog opens, the injected JavaScript executes automatically in the victim's browser session with no further interaction. No public exploit code was identified at time of analysis.