Quick answers
- Is CVE-2026-19723 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-19723 being exploited in the wild.
- How severe is CVE-2026-19723?
- High severity, with a CVSS score of 7.1, published 2 September 2026.
- Which products and versions are affected?
- WPScan Social Media Share Buttons & Social Sharing Icons before 3.0.1.
- Is there a fix for CVE-2026-19723?
- A patch was published on 2026-09-02: Fixed in version 3.0.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-19723 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-19723?
- Check whether you run WPScan Social Media Share Buttons & Social Sharing Icons at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a Reflected XSS vulnerability (CWE-79) in the WordPress plugin that fails to properly escape user-supplied input from the HTTP request before rendering it within an inline JavaScript event handler. The vulnerability requires the plugin to be configured with a non-default icon display mode. An attacker crafts a malicious link and tricks a user into clicking it while they are logged into a website using the affected plugin; the injected JavaScript then executes in the victim's browser session, allowing account takeover or data theft. The vulnerability has been patched in version 3.0.1 and is publicly disclosed, though active exploitation in the wild has not yet been observed.
Affected products
- WPScan Social Media Share Buttons & Social Sharing Icons before 3.0.1
Timeline
- 2026-08-31: disclosed: Publicly published
- 2026-09-02: patched: Fixed in version 3.0.1