Executive brief
Hubbub Lite is a WordPress plugin used to add social sharing buttons and tools to websites. A security vulnerability allows users with 'Contributor' level access to inject malicious scripts into the site. If a site administrator views the affected content, these scripts could execute, potentially leading to unauthorized actions or the theft of sensitive session information.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the NerdPress Hubbub Lite plugin (formerly Social Pug) for WordPress in versions up to and including 1.36.3. The flaw is caused by improper neutralization of user-supplied input during web page generation (CWE-79). An attacker with Contributor-level privileges can inject arbitrary JavaScript into certain plugin fields. This script executes in the browser of any user (typically an administrator) who views the malicious content. Successful exploitation requires user interaction and can lead to session hijacking or unauthorized administrative actions. As of the advisory date, no official patch has been confirmed.
Affected products
- NerdPress Hubbub Lite <= 1.36.3
Timeline
- 2025-11-07: other: Vulnerability reported by researcher zaim
- 2026-07-22: advisory: Advisory published by Patchstack
- 2026-07-23: disclosed: CVE published to NVD dataset