Description

The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not escape the post title before outputting it in an inline JavaScript event handler, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks which are triggered when a visitor interacts with the affected button. Exploitation requires the Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 to be running a non-default icon display configuration.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-09-02T06:17:17.037Z",
  "pubdate": "2026-09-02T06:17:17.037Z",
  "executiveSummary": "The Social Media Share Buttons & Social Sharing Icons WordPress plugin, specifically versions prior to 3.0.1, is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. The flaw resides in the inadequate sanitization and output escaping of post titles before they are rendered within inline JavaScript event handlers.\nThis vulnerability allows an attacker with at least the Contributor role to inject malicious JavaScript payloads into post metadata. When a visitor interacts with a social media share button on an affected page, the malicious script executes within the context of the victim's browser session. The primary impact includes potential session hijacking, unauthorized actions on behalf of the user, and the exfiltration of sensitive information.\nSuccessful exploitation is contingent upon the WordPress site utilizing a non-default icon display configuration within the plugin settings. Given the ability of Contributors to manipulate content, this vulnerability represents a significant security risk to the integrity of site visitors' browsing sessions.",
  "technicalDetails": "The root cause of this vulnerability is improper neutralization of input during the generation of dynamic JavaScript code. Specifically, the plugin fails to escape post titles when injecting them into inline event handlers (such as 'onclick' or 'onmouseover') associated with social sharing icons.\nIn the WordPress ecosystem, a user with the Contributor role has the authority to draft posts and submit them for review. By embedding a crafted payload within the post title—for instance, including single quotes followed by JavaScript event handlers such as 'onmouseover=alert(document.cookie)'—the attacker can break out of the intended HTML attribute context.\nThe attack flow proceeds as follows: First, the authenticated contributor creates or edits a post, inserting the XSS payload into the post title field. Upon saving or submitting the post, the malicious title is stored in the WordPress database. Second, when a site visitor navigates to the front-end page where the Social Media Share Buttons & Social Sharing Icons plugin is active, the plugin retrieves the compromised post title from the database.\nThe vulnerability is triggered if the plugin is configured with a non-default icon display setting, which forces the plugin to render the vulnerable title string directly into an inline JavaScript snippet. Because the input lacks output escaping, the browser interprets the attacker's payload as executable code rather than plain text. When the user interacts with the social sharing icon in the manner specified by the injected payload, the JavaScript executes within the security context of the victim's session.\nThe potential post-exploitation impact is extensive. Since the malicious script runs under the victim's browser session, it can perform unauthorized requests, steal session cookies if HttpOnly flags are missing, or redirect the user to malicious external sites. Because this is a stored XSS vulnerability, the payload persists until the post is deleted or the malicious title is corrected, posing a continuous threat to any user interacting with the affected interface elements.\nThis vulnerability highlights a critical failure in following secure coding practices regarding dynamic data output in JavaScript-heavy environments, specifically the failure to apply context-aware encoding or escaping before rendering user-controlled data into executable sinks."
}