Read the docs
TI-2026-70345 Aliases CVE-2026-42697GHSA-rrq4-gwwv-8jx3

Reflected cross-site scripting in Social Share Icons WordPress plugin

Priority LOW 30CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · Low
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

The Social Share Icons & Social Share Buttons plugin for WordPress from Inisev, up to and including 3.7.5, does not neutralize input in the web pages it generates. An unauthenticated remote attacker can inject script that runs in a victim's browser after the victim interacts with a crafted page (CWE-79).

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Inisev Social Share Icons & Social Share Buttons ultimate-social-media-plus allows Reflected XSS.This issue affects Social Share Icons & Social Share Buttons: from n/a through 3.7.5.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00175 6th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
inisevSocial Share Icons & Social Share Buttonsup to 3.7.5—No fix listedCNA
  • Social Share Icons & Social Share Buttons Vendorinisev Affected up to 3.7.5 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Social Share Icons & Social Share Buttons.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-11 Threatist record created from CVE-2026-42697
  2. 2026-10-11 Alias added: GHSA-rrq4-gwwv-8jx3
  3. 2026-10-13 Affected versions changed · CNA

References

Other 1

  • TI-2023-06004 Backup Migration <= 1.3.7 - Unauthenticated Remote Code Execution CVSS 3.1CRITICAL 9.8
  • TI-2024-00517 Enhanced Text Widget < 1.6.6 - Admin+ Stored XSS CVSS 3.1MEDIUM 6.5
  • TI-2023-01258 Redirection < 1.1.5 - Plugin Reset via CSRF CVSS 3.1MEDIUM 6.5
  • TI-2023-01257 Redirection < 1.1.4 - Redirect Creation via CSRF CVSS 3.1MEDIUM 6.5
  • TI-2024-00519 Ultimate Posts Widget < 2.3.1 - Admin+ Stored XSS CVSS 3.1MEDIUM 5.4
  • TI-2023-06399 Backup Migration <= 1.3.9 - Authenticated (Admin+) OS Command Injection via url CVSS 3.1HIGH 7.2
See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences