Executive brief
The Social Media Share Buttons & Social Sharing Icons WordPress plugin, used by website administrators to add shareable buttons for social networks, contains a reflected cross-site scripting (XSS) vulnerability. When users interact with the share buttons on a website running an affected version with non-default icon settings, attackers can inject malicious scripts that steal session data or perform unauthorized actions on behalf of the victim.
Technical details
This is a Reflected XSS vulnerability (CWE-79) in the WordPress plugin that fails to properly escape user-supplied input from the HTTP request before rendering it within an inline JavaScript event handler. The vulnerability requires the plugin to be configured with a non-default icon display mode. An attacker crafts a malicious link and tricks a user into clicking it while they are logged into a website using the affected plugin; the injected JavaScript then executes in the victim's browser session, allowing account takeover or data theft. The vulnerability has been patched in version 3.0.1 and is publicly disclosed, though active exploitation in the wild has not yet been observed.
Affected products
- WPScan Social Media Share Buttons & Social Sharing Icons before 3.0.1
Timeline
- 2026-08-31: disclosed: Publicly published
- 2026-09-02: patched: Fixed in version 3.0.1