CVE-2026-105259: Easy Social Icons < 4.0.3 - Author+ Stored XSS via SVG Upload

Q: Who can exploit this issue?

On affected installations, any user with the Author role or a higher privilege level can upload a malicious SVG. If another affected Easy Social Icons plugin exposes an unauthenticated upload route, an attacker may be able to trigger the issue without an account.

Q: Are default WordPress upload settings enough to prevent exploitation?

No. The affected plugin adds SVG to the site-wide set of permitted upload file types, and it does not sanitize uploaded SVG files.

Q: What is the immediate mitigation if updating is not possible?

Restrict or disable SVG uploads and remove access to any upload routes exposed to unauthenticated visitors. Review uploaded SVG files for embedded XSS payloads.

Q: How can administrators determine whether they are affected?

Check whether Easy Social Icons is installed at a version earlier than 4.0.3 and whether SVG uploads are permitted site-wide. Also identify any other affected Easy Social Icons installation that provides an unauthenticated upload route.

Published Nov 5, 2026

Updated

The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise SVG files, which it adds to the list of file types that may be uploaded site-wide, allowing users with the Author role and above to upload a malicious SVG containing XSS payloads. Where another installed Easy Social Icons WordPress plugin before 4.0.3 exposes an upload route to unauthenticated visitors, the same issue can be triggered without an account.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Easy Social Icons to a version that resolves this vulnerability.
Fixed in 4.0.3

Event History

Nov 5, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Who can exploit this issue?

On affected installations, any user with the Author role or a higher privilege level can upload a malicious SVG. If another affected Easy Social Icons plugin exposes an unauthenticated upload route, an attacker may be able to trigger the issue without an account.

Are default WordPress upload settings enough to prevent exploitation?

No. The affected plugin adds SVG to the site-wide set of permitted upload file types, and it does not sanitize uploaded SVG files.

What is the immediate mitigation if updating is not possible?

Restrict or disable SVG uploads and remove access to any upload routes exposed to unauthenticated visitors. Review uploaded SVG files for embedded XSS payloads.

How can administrators determine whether they are affected?

Check whether Easy Social Icons is installed at a version earlier than 4.0.3 and whether SVG uploads are permitted site-wide. Also identify any other affected Easy Social Icons installation that provides an unauthenticated upload route.

CVE-2026-105259: Easy Social Icons < 4.0.3 - Author+ Stored XSS via SVG Upload

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Are default WordPress upload settings enough to prevent exploitation?

What is the immediate mitigation if updating is not possible?

How can administrators determine whether they are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Are default WordPress upload settings enough to prevent exploitation?

What is the immediate mitigation if updating is not possible?

How can administrators determine whether they are affected?