CVE-2026-109702: WordPress Social Share Buttons plugin <= 1.31 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in maxfoundry Social Share Buttons share-button allows Stored XSS.This issue affects Social Share Buttons: from n/a through 1.31.
Affected Software
Event History
Frequently Asked Questions
Which installations are affected?
Maxfoundry Social Share Buttons versions through 1.31 are affected. The available data does not identify a fixed version or state whether any particular configuration avoids the issue.
What does exploitation require?
The vulnerability is stored XSS with network access, low attack complexity, no required privileges, and user interaction required. An attacker must be able to submit crafted input that is later rendered in a web page and viewed by a user.
What is the potential impact?
The reported CVSS vector indicates low confidentiality, integrity, and availability impacts, with scope changed. Successful exploitation may affect a security authority beyond the vulnerable plugin's own scope.