CVE-2026-66623: WordPress Social Media & Share Icons plugin <= 2.9.9 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Social Media & Share Icons <= 2.9.9 versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Social Media & Share Icons pluginto a version that resolves this vulnerability.Fixed in 3.0.0
Event History
Frequently Asked Questions
Who can exploit this issue?
The issue is described as unauthenticated, so an attacker does not need a WordPress account or prior privileges. Exploitation requires user interaction, as indicated by the UI:R vector.
What security impact could successful exploitation have?
The CVSS vector indicates low-impact compromise of confidentiality, integrity, and availability, with scope changed. As an XSS issue, successful exploitation could execute attacker-controlled script in a victim's browser context.
Which plugin versions are affected?
Social Media & Share Icons versions 2.9.9 and earlier are affected according to the available data.