Security Alert Summary
The Social Media Share Buttons & Social Sharing Icons plugin before 3.0.1 fails to escape the post title before placing it into an inline JavaScript event handler. This allows users with the Contributor role and above to store JavaScript that is executed when a visitor interacts with an affected sharing button, provided a non-default icon display configuration is in use.
CVE Details
- CVE ID:
CVE-2026-19719 - Affected component: Social Media Share Buttons & Social Sharing Icons WordPress plugin
- Affected versions: Versions less than 3.0.1
- Published: September 2, 2026 at 6:17:17 AM
- Last modified: September 2, 2026 at 11:17:19 AM
- CVSS v3.1: Base score 6.8, Severity MEDIUM
- Vector string:
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H - Authentication / privileges / interaction:
- Attack Vector: NETWORK
- Privileges Required: HIGH (requires Contributor role or above to create the malicious input)
- User Interaction: REQUIRED (attacker-supplied payload is executed when a visitor interacts with the button)
- Scope: UNCHANGED
- Primary impact: Confidentiality: HIGH; Integrity: HIGH; Availability: HIGH
- CWE / weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-site Scripting)
- SSVC notes (from source):
- Exploitation: none
- Automatable: no
- Technical impact: total
Technical Details
According to the report, the plugin does not escape the post title prior to outputting it inside an inline JavaScript event handler. Because the post title may be controlled by users with the Contributor role or higher, an attacker with those privileges can store a payload in a post title. The payload is executed when a site visitor interacts with the affected share button, resulting in stored cross-site scripting (XSS).
The issue is conditional on a non-default icon display configuration being in use; the vulnerability is not triggered by the default icon display settings. No specific functions or REST endpoints are named in the provided data.
Impact is limited to the effects of stored XSS as described: execution of attacker-supplied script in the context of a visitor’s browser, which can expose data accessible to the page, modify page content, or perform actions the visitor can perform.
How This Could Impact Your Website
On a multi-user WordPress site, an internal content contributor or an external contractor with Contributor-level access could create a post whose title contains a malicious script. When a site visitor interacts with a sharing button that is using a non-default icon display configuration, the stored script could execute in that visitor’s browser.
Practical consequences include exposure of data available in the page context (for example, information displayed to the visitor), and an increased risk of targeted phishing or social engineering if an attacker can access or infer internal user details. Stored XSS can also be used to modify content shown to visitors or to perform actions on behalf of a visitor within the limits of their session.
If you re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially Contributor and higher roles.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual behavior, including unexpected content in post titles or changes to sharing configurations.
If you d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
