6.8
Medium
CVE-2026-105259 Easy Social Icons < 4.0.3 - Author+ Stored XSS via SVG Upload
Description
The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise SVG files, which it adds to the list of file types that may be uploaded site-wide, allowing users with the Author role and above to upload a malicious SVG containing XSS payloads. Where another installed Easy Social Icons WordPress plugin before 4.0.3 exposes an upload route to unauthenticated visitors, the same issue can be triggered without an account.
CVSS 3.1 detail
Vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:HExploitable remotely over the network, with an administrator account and if a user takes an action; an attacker can seriously compromise confidentiality, integrity or availability.
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- High
- Interaction
- Required
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Easy Social Icons 4.0 | earliest → < 4.0.3 | 4.0.3 |
Other CVEs of Easy Social Icons
The 4 CVEs of Easy Social Icons →
CVE-2025-15701
Easy Social Icons < 4.0.3 - Admin+ Stored XSS via Icon Color Settings
3.5
Low
CVE-2022-0840
The Easy Social Icons WordPress plugin before 3.2.1 does not properly escape the image_file field when adding a new…
Not rated
CVE-2022-0887
The Easy Social Icons WordPress plugin before 3.1.4 does not sanitize the selected_icons attribute to the cnss_widget…
Not rated