Unknown Social Media Share Buttons & Social Sharing Icons vulnerabilities
4 vulnerabilities
Known vulnerabilities in Unknown Social Media Share Buttons & Social Sharing Icons, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
MediumCVE-2024-2118inisev · social_media_share_buttons_\&_social_sharing_icons +2 moreSocial Media Share Buttons < 2.8.9 - Admin+ Stored XSS via settingsThe Social Media Share Buttons & Social Sharing Icons WordPress plugin before 2.8.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)EPSS0.40%MediumCVE-2024-10362inisev · social_media_share_buttons_\&_social_sharing_icons +2 moreSocial Media Share Buttons < 2.9.0 - Admin+ Stored XSSThe Social Media Share Buttons & Social Sharing Icons WordPress plugin before 2.9.1 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)EPSS0.36%MediumCVE-2026-19719unknown · social media share buttons & social sharing icons +1 moreSocial Media Share Buttons & Social Sharing Icons < 3.0.1 - Contributor+ Stored XSS via Post TitleThe Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not escape the post title before outputting it in an inline JavaScript event handler, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks which are triggered when a visitor interacts with the affected button.
Exploitation requires the Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 to be running a non-default icon display configuration.EPSS0.29%HighCVE-2026-19723unknown · social media share buttons & social sharing icons +1 moreSocial Media Share Buttons & Social Sharing Icons < 3.0.1 - Reflected XSS via Pin It Share HandlerThe Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not properly escape a value taken from the incoming request before outputting it in an inline JavaScript event handler, leading to Reflected Cross-Site Scripting which is triggered when a user interacts with the affected button.
Exploitation requires the Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 to be running a non-default icon display configuration.EPSS0.18%