Security Alert Summary
The Social Rocket – Social Sharing Plugin for WordPress contains a stored Cross-Site Scripting (XSS) vulnerability in the id parameter in all versions up to and including 1.3.4.2. Authenticated users with Subscriber-level access or higher can inject scripts that will execute when an affected page is viewed by another user.
CVE Details
- CVE ID: CVE-2026-1923
- Affected component: The Social Rocket – Social Sharing Plugin plugin for WordPress
- Affected versions: All versions up to, and including, 1.3.4.2
- Published: April 23, 2026 2:16 AM UTC
- Last modified: April 23, 2026 2:28 PM UTC
- CVSS v3.1: Base Score 6.4, Severity MEDIUM
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Authentication / privileges / user interaction: Requires authentication; low privileges (authenticated user such as Subscriber-level); no user interaction required.
- Primary impact: Confidentiality: Low; Integrity: Low; Availability: None
- Weakness (CWE): CWE-79 (Improper Neutralization of Input During Web Page Generation)
Technical Details
The issue is a stored Cross-Site Scripting (XSS) vulnerability caused by insufficient input sanitization and output escaping for the id parameter. Because the plugin stores attacker-supplied input and later renders it into pages without proper escaping, an authenticated user with Subscriber-level access or higher can inject arbitrary web scripts into pages.
When a victim views a page containing the injected payload, the browser will execute the injected script in the context of the site. The description identifies the id parameter as the injection point; no additional functions, endpoints, or patches are referenced in the provided data.
How This Could Impact Your Website
Consider a site where a site owner manages posts and several contributors or external contractors have Subscriber- or Contributor-level accounts for commenting or limited content access. An authenticated user with Subscriber-level access could inject a script via the id parameter. When other users or administrators visit the injected page, the script may run in their browser context.
Practical consequences include exposure of account-related data visible in the browser (for example, email addresses displayed on profile or author pages), and an increased risk of targeted phishing or social engineering attacks using information gathered from the affected pages. The impact aligns with the CVSS assessment: it can affect confidentiality and integrity at a limited level but does not by itself indicate site-wide availability loss.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially accounts with contributor-or-above access.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual behavior, particularly changes to content that could include script payloads.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
