6.8
Medium
CVE-2026-19719 The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not escape the post title…
Description
The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not escape the post title before outputting it in an inline JavaScript event handler, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks which are triggered when a visitor interacts with the affected button. Exploitation requires the Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 to be running a non-default icon display configuration.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Social Media Share Buttons & Social Sharing Icons 3.0 | earliest → < 3.0.1 | 3.0.1 |
Other CVEs of Social Media Share Buttons & Social Sharing Icons
The 4 CVEs of Social Media Share Buttons & Social Sharing Icons →
CVE-2026-19723
The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not properly escape a value…
7.1
High
CVE-2024-10362
The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 2.9.1 does not sanitize and escape some of…
4.8
Medium
CVE-2024-2118
The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 2.8.9 does not sanitise and escape some of…
5.9
Medium