CVE-2026-100108: Social Share Buttons <= 1.30 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'share_url' Network Setting
The Social Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form (containing shareurl)' parameter in all versions up to, and including, 1.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the 7-day review-nag timer has elapsed since the attacker's first wp-admin visit, as the nonce needed to reach the save-network handler is only rendered in the DOM once that timer has passed.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to the WordPress site with at least Subscriber-level access. They also need to wait until seven days after their first wp-admin visit, when the nonce for the save-network handler becomes available in the DOM.
What is required for the malicious script to run?
The attacker must submit a crafted form containing the share_url parameter to store the payload. The stored script executes when a user accesses the page where the injected content is rendered.
Are installations running version 1.30 affected?
Yes. The issue affects all Social Share Buttons versions up to and including 1.30.