CVE-2026-42697: WordPress Social Share Icons & Social Share Buttons plugin <= 3.7.5 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Inisev Social Share Icons & Social Share Buttons ultimate-social-media-plus allows Reflected XSS.This issue affects Social Share Icons & Social Share Buttons: from n/a through 3.7.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Social Share Icons & Social Share Buttonsto a version that resolves this vulnerability.Fixed in 3.7.6
Event History
Frequently Asked Questions
Who can exploit this issue?
The vulnerability is unauthenticated, so an attacker does not need a WordPress account or prior access to the site. Exploitation requires user interaction, as indicated by the UI:R vector.
Which installations are affected?
WordPress sites using Social Share Icons & Social Share Buttons version 3.7.5 or earlier are affected.
What is the potential impact?
Successful exploitation can execute cross-site scripting in a user’s browser and may affect confidentiality, integrity, and availability at a low level. The CVSS vector indicates the impact can extend beyond the vulnerable component’s security scope.