CVE-2026-19723: Social Media Share Buttons & Social Sharing Icons < 3.0.1 - Reflected XSS via Pin It Share Handler
The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not properly escape a value taken from the incoming request before outputting it in an inline JavaScript event handler, leading to Reflected Cross-Site Scripting which is triggered when a user interacts with the affected button. Exploitation requires the Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 to be running a non-default icon display configuration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/Social Media Share Buttons & Social Sharing Iconsto a version that resolves this vulnerability.Fixed in 3.0.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
WordPress sites running Social Media Share Buttons & Social Sharing Icons versions before 3.0.1 are affected only when using a non-default icon display configuration. The default icon display configuration is not identified as affected by the provided information.
What does an attacker need to do to exploit it?
An attacker must cause a user to interact with the affected Pin It share button after supplying a crafted request value. The malicious value is reflected into an inline JavaScript event handler.
What can be done if updating is not immediately possible?
Switching away from the non-default icon display configuration removes the stated exploitation prerequisite. Users should also avoid interacting with affected Pin It share buttons reached through untrusted links until the plugin can be updated.