Executive brief
The Shariff for WordPress plugin, used to add privacy-friendly social sharing buttons to websites, contains a security flaw in its settings configuration. An administrator could save malicious code into the plugin's settings that would then execute in the browsers of other visitors or staff members. This is particularly relevant for WordPress Multisite environments where site administrators are normally restricted from adding custom scripts.
Technical details
A Stored Cross-Site Scripting (XSS) vulnerability exists in the Shariff for WordPress plugin (up to version 1.0.11) within the generateshariff() function. The root cause is the failure to sanitize or escape the 'shariff_infourl' configuration setting before it is output as a 'data-info-url' attribute in the frontend HTML. An attacker with administrative privileges can inject a payload (e.g., via an img tag with an onerror handler) into the settings. This payload is then stored and executed in the context of any user visiting a post where the sharing buttons are displayed. This bypasses 'unfiltered_html' restrictions typically found in WordPress Multisite installations. As of the advisory date, no fix has been identified.
Affected products
- Unknown Shariff for WordPress <= 1.0.11
Timeline
- 2026-05-29: other: Vulnerability added to WPScan database
- 2026-06-05: disclosed: Publicly published by WPScan
- 2026-06-27: advisory: NVD published CVE-2026-9677