Executive brief
The Social Media Share Buttons & Social Sharing Icons WordPress plugin is used to display social sharing buttons on blog posts. In vulnerable versions before 3.0.1, the plugin fails to escape post titles before inserting them into JavaScript code, allowing attackers with Contributor-level access (or higher) to inject malicious JavaScript. When visitors click the affected social buttons, the injected code executes in their browsers, potentially stealing session data or performing actions on their behalf.
Technical details
This is a Stored Cross-Site Scripting (XSS) vulnerability in the Social Media Share Buttons & Social Sharing Icons WordPress plugin (CWE-79). The plugin outputs post titles directly into inline JavaScript event handlers without proper escaping when using the non-default "Original icons" display mode. An attacker with Contributor role or higher can craft a post title containing numeric character references (e.g., " for a quote) that bypass server-side filters, and when the HTML is parsed by the browser, these are decoded into executable JavaScript. The vulnerability is triggered when a visitor clicks the affected social sharing button. Exploitation requires the plugin to run with non-default icon display settings, specifically using "Original icons" rather than the shipped "Responsive icons" default. The vulnerability was fixed in version 3.0.1.
Affected products
- Ultimate Web Designs Social Media Share Buttons & Social Sharing Icons before 3.0.1
Timeline
- 2026-08-31: disclosed
- 2026-09-01: patched: Fixed in version 3.0.1